E4GL30S1NT bundles OSINT lookups into one auditable CLI

A command per capability, with a provider layer underneath

E4GL30S1NT is described as a simple information gathering toolkit, a modular OSINT command line tool for username recon, email discovery, phone lookup, breach intelligence, metadata extraction, network analysis and more. The command list is the easiest way to see the scope. There is userrecon for username reconnaissance across more than 71 social platforms using a data-driven YAML registry, facedumper to dump a Facebook friend list with IDs, emails, phones, birthdays and locations, mailfinder to discover email addresses from a person's name, godorker for Google dorking with automatic result scraping, phoneinfo for number validation and carrier information, dns and whois for lookups, subnet as a network calculator, hostfinder and dnsfinder for discovering hosts, riplookup and iplocation for the reverse direction, bitly to resolve short URLs, github to dump a user profile, tempmail to generate an address and monitor the inbox, metadata to extract EXIF and GPS from images and author and producer information from PDFs, and breach to check email and phone exposure against Have I Been Pwned, DeHashed and LeakCheck. There is also a set of session commands, with investigation new to create a named session and investigation list to show them all, plus settings for keys and configuration and update for a self-upgrade. The primary language is Python and the version is 2.1.0, requiring Python 3.11 or newer.

The 2.1 release brought the parts that make it an investigation tool

The release notes for v2.1.0 are where the project explains itself, and the theme is record keeping rather than more lookups. Breach intelligence queries Have I Been Pwned, DeHashed and LeakCheck to check whether emails or phone numbers have been exposed. Metadata extraction pulls EXIF data from images, including GPS coordinates, device information and camera settings, and author, creator and producer metadata from PDFs. PII masking is automatic, with structured output masked for emails, phones, IPs and hostnames, and a --show-pii flag to reveal the raw values. The platform registry moved from 71 hardcoded platform URLs into a community-updatable platforms.yaml file, which is a better design because the URLs are the part that breaks. Audit logging records every provider query to an append-only JSONL trail with SHA256-hashed queries and session tracking. Structured output gives every command the --output json|csv, --output-file and --save-to options. Investigation sessions are named and stored in SQLite so entities and results persist across runs. The provider results are typed Pydantic v2 models, and all providers follow a consistent execute() and run() pattern with automatic audit logging.

Installing on Linux or from source

There is a one script path for Linux and a manual path that works everywhere. The Linux script is the quickest route, and it is two commands:

wget https://raw.githubusercontent.com/C0MPL3XDEV/E4GL30S1NT/main/linuxinstall.sh
bash linuxinstall.sh

The script detects whether you are on a Debian, Ubuntu or Kali system with apt, an Arch-based system with pacman or a Fedora-based system with dnf, then installs the system packages python3, python3-venv, libxml2, libxslt1.1, curl and git, clones the repository to ~/.local/share/eagleosint, creates a virtual environment and installs the package, and adds the eagleosint and e4gl launchers to /usr/local/bin. The manual route is the same three step shape on any platform:

git clone https://github.com/C0MPL3XDEV/E4GL30S1NT.git
cd E4GL30S1NT
curl -LsSf https://astral.sh/uv/install.sh | sh   # skip if uv already installed
uv tool install .

and you confirm the install with:

eagleosint --help

The stated runtime requirements are Python 3.11 or newer, curl, which is used by iplocation to detect the local IP, and wget on Linux for the update command, plus API keys for the optional features. The keys are stored in ~/.config/E4GL30S1NT/config.json, and the settings command is the way to manage them.

The CLI is click-based, and every command takes a structured output flag

The usage section shows two ways in. Running eagleosint or e4gl with no arguments opens an interactive menu, and each subcommand can also be invoked directly, for example eagleosint userrecon for username recon or eagleosint breach for breach intelligence. Any subcommand can also be run as a module with python -m eagleosint and a command name. The structured output options are the same everywhere:

eagleosint userrecon --output json                    # JSON to stdout
eagleosint mailfinder --output csv -f results.csv     # CSV to file
eagleosint phoneinfo --output json --show-pii         # unmasked PII
eagleosint github --output json --save-to case-001    # save to investigation

The -f flag is a short form for the output file, --show-pii is the explicit override for the masking, and --save-to names the investigation the result is stored against. The dependency list in the packaging metadata explains the implementation, with click for the command line, requests and beautifulsoup4 with lxml for the fetching and parsing, googlesearch-python for the dorker, tabulate for the console tables, pydantic for the typed results, sqlalchemy for the SQLite sessions, platformdirs for the config location, pyyaml for the platform registry, Pillow and pdfplumber for the metadata extraction, and pyinstaller in the dev group for a packaged build. The entry point is a single main function in eagleosint.cli, exposed under both the eagleosint and the e4gl names.

What the tool cannot promise

The limits are worth stating clearly because the tool is broad. Several commands work by scraping pages on other services, userrecon against 71 platforms, godorker against search results, facedumper against a social network, and the breach lookups against three providers, and none of those are under the project's control, so the results are only as good as the current state of those sites. The platforms.yaml registry is a mitigation rather than a fix, since a community-updatable file can be updated faster than a release but still lags. The masked output is another trade. It is the right default for a tool that produces personal data, but it means a scripted consumer needs --show-pii on every call or it will save redacted records, and the masking is applied to structured output rather than to the raw provider results, so it is worth checking which path your pipeline takes. The temp mail and Bitly commands similarly depend on the behaviour of third party services. And the licensing position is the part an organisation should read carefully. The project is GPL-3.0, so incorporating it into a closed source product carries the copyleft obligations, and the project also has a home page and a Discord, which suggests an active single author rather than a foundation project.

Editorial conclusion

Adopt E4GL30S1NT when you are doing OSINT collection that needs to be recorded rather than just printed, since the audit trail, investigation sessions and structured output are the differentiators. Do not adopt it as an automated scraping pipeline you can run at scale, since several commands scrape third party pages and their reliability is outside the project's control. Verify first that the platforms you care about are in the community-updatable platforms.yaml registry, that you understand the default PII masking and how to turn it off deliberately, and that the terms of the services you query permit the collection you intend.

Frequently asked questions

Official sources

1. C0MPL3XDEV/E4GL30S1NT on GitHub
2. License: GPL-3.0
3. Project website
4. README
5. Releases