MailAccess: Open Source Marketing & Customer Engagement

What is MailAccess?

MailAccess is a free, self-hostable email OSINT platform, shipped on PyPI as mailaccess, that fans a single address out across breach databases, social networks, DNS records, and the open web and returns a unified exposure score, built for security researchers, OSINT analysts, and penetration testers working under authorization.

What it is

MailAccess is an open-source Python investigation platform for email addresses, published under the MIT licence and developed in the open on GitHub. It takes one address or one domain and correlates what it finds across many independent sources at once: breach corpora, social networks, username registries, DNS records, certificate transparency logs, and public web pages. The result is a structured investigation — an identity graph, an exposure score, and a set of findings graded by confidence — rather than a pile of raw hits, and every finding can be exported or piped into downstream tooling such as Maltego.

The concrete problem it solves is the manual fan-out that email investigations otherwise require. An analyst normally opens a dozen separate sites, repeats the same address in each one, and stitches the results together by hand, with no consistent scoring and no shared record of what was checked. MailAccess replaces that ad-hoc sequence of separate breach lookups, username searches, DNS checks, and dork queries with one command that stops when the investigation is done. It lives in the Python and PyPI ecosystem, so it installs and runs alongside the rest of a researcher's scripting environment, and it can be self-hosted when the work cannot leave a controlled network.

Key capabilities

Identity graph that correlates accounts, usernames, names, avatars, breach data, and profile links, viewable at /investigation/:id/graph or exportable through GET /api/report/{id}/graph.
Name Consensus Engine that synthesizes independent name signals into confirmed, probable, possible, or unknown identity bands.
Credential Risk Score: a separate 0–100 exposure band with top drivers and recommended next steps, distinct from the overall exposure score.
Defender's Brief: a security-manager-ready risk summary with prioritized findings and one concrete next action.
harvest-emails discovers organization addresses across Common Crawl, GitHub, CT logs, registries, keyservers, dorks, employee pages, and naming patterns.
find-email turns a name plus an employer domain into one honestly graded likely address, offline, from a bundled 384K-domain pattern index, with Microsoft 365 mailboxes verified where the provider allows.
5,300+ platform username corpus with two-marker detection and zero runtime dependencies, plus a native account-existence engine covering 357 email-checkable services and native Google-account intelligence.
Six export formats: JSON, CSV, PDF, Markdown, STIX 2.1, and Maltego XML.

Who uses it and how

Security researchers and OSINT analysts running authorized investigations, after reading DISCLAIMER.md.
Penetration testers checking credential exposure, optionally supplying their own breach key with mailaccess keys set HIBP_API_KEY your-key.
Teams that need a persistent endpoint rather than per-run processes, using mailaccess serve and the HTTP API.
Automation and CI pipelines, using stdin, JSONL, and the examples in docs/integrations.md.
Lead-generation and marketing teams in the Marketing & Customer Engagement space, using mailaccess harvest-emails --domain company.com --mode public-business-contact.

Getting started

Install with pip install mailaccess, then run mailaccess investigate you@example.com; the CLI starts and stops the backend automatically for each investigation. Docker, persistent server, and self-hosting instructions live in docs/self-hosting.md.

How it compares

No comparable project is named in this registry, so MailAccess stands alone here; the closest named touchpoints are Maltego and STIX 2.1, which it exports to rather than competes with. Against its own paid tier, the open-source core is MIT-licensed and self-hostable at no cost, while MailAccess Pro adds decision-maker contacts with name, role, company, email, and LinkedIn behind a Pro key.

When to use it — and when not to

A self-hoster must run the backend, and optional capabilities add real setup: mailaccess[ml] pulls in spaCy for name classification, and mailaccess[browser] requires playwright install chromium before the headless-browser account-existence oracles work. Anyone without explicit authorization to investigate the target should not use it at all, and users who want a fully managed hosted service should look elsewhere. The honest limitation is scope: the free harvest finds publicly available addresses but not the decision-makers behind a domain, since that enrichment is gated behind a paid MailAccess Pro key.

project readme (upstream, from github) — read inline

_{Let's connect}

mailaccess.pro · Docs · PyPI · Changelog

Self-hostable OSINT platform for investigating email addresses. Fan out across breach databases, social networks, DNS records, and the open web, then get back a unified exposure score and structured findings you can export or pipe into Maltego.

Built for security researchers, OSINT analysts, and penetration testers operating under authorization. Read DISCLAIMER.md before use.

Install

pip install mailaccess
mailaccess investigate you@example.com

The CLI auto-starts and stops the backend for each investigation. Use mailaccess serve when you want a persistent server, install mailaccess[ml] for optional spaCy-based name classification, or mailaccess[browser] (then playwright install chromium) for the optional headless-browser account-existence oracles.

Full install options (Docker, persistent server, self-hosting) in docs/self-hosting.md.

Quick Start

mailaccess investigate you@example.com
mailaccess investigate you@example.com -o report.pdf
mailaccess harvest-emails --domain company.com
mailaccess harvest-emails --domain company.com --export harvest.csv
mailaccess find-email --name "Jane Doe" --domain company.com
mailaccess keys set HIBP_API_KEY your-key
mailaccess pro
mailaccess upgrade
mailaccess serve

Pipeline, stdin, JSONL, and CI examples in docs/integrations.md.

What It Does

Identity graph: cross-platform correlation of accounts, usernames, names, avatars, breach data, and profile links. View it at /investigation/:id/graph or export with GET /api/report/{id}/graph.
Name Consensus Engine: synthesizes independent name signals into confirmed, probable, possible, or unknown identity bands.
Defender's Brief: security-manager-ready risk summary with prioritized findings and a concrete next action.
Credential Risk Score: separate 0-100 credential exposure band with top drivers and recommended next steps.
Domain email harvesting: harvest-emails discovers organization addresses across Common Crawl, GitHub, CT logs, registries, keyservers, dorks, employee pages, and patterns. (Pro adds the decision-makers behind the domain.)
Company email patterns: find-email turns a name plus an employer domain into one honestly-graded likely address, offline from a bundled 384K-domain pattern index. Microsoft 365 mailboxes are verified where the provider allows.
5,300+ platform corpus: a native username-platform engine over a MailAccess-verified corpus of 5,300+ platform definitions, with two-marker detection and zero runtime dependencies. Plus a native account-existence engine covering 357 email-checkable services — consumer apps, SaaS, and community forums, checked non-intrusively (full platform list & methods) — and native Google-account intelligence.
Deep breach mode: probes the highest-severity breach corpus for account-existence risk.
6 export formats: JSON, CSV, PDF, Markdown, STIX 2.1, and Maltego XML.

MailAccess Pro

Your free harvest finds the addresses that are public. It does not find the people who make the decisions.

The names that matter, heads of security, procurement, and engineering, rarely show up in Common Crawl, CT logs, or a GitHub commit. MailAccess Pro closes that gap. Add a Pro key and any lead-gen harvest is enriched with real business contacts, each carrying name, role, company, email, and LinkedIn, aggregated from publicly-available and third-party commercial sources. One command turns a bare domain into a working outreach list:

$ mailaccess harvest-emails --domain acme.com
  312 addresses found

$ mailaccess harvest-emails --domain acme.com --mode public-business-contact
  312 found · 968 available with Pro
  ──────────────────────────────────────────────────────────────────
  Dana Reed    VP Security           Acme   dana.reed@acme.com   in/danareed
  Sam Okoye    Head of Procurement   Acme   s.okoye@acme.com     in/samokoye
  Priya Nair   Director, Platform    Acme   priya@acme.com       in/priyanair
  … 653 more business contacts (name, role, company, email, LinkedIn)

Why teams upgrade:

See the gap before you pay. Every free harvest prints the exact number of extra contacts Pro would add for that domain. No guessing, no vague multiplier.
Coverage the open web cannot give you. Reach the budget-owners and inboxes that public crawling misses entirely.
Company-name resolution. Skip the domain lookup: --company "Stripe" resolves it for you.
Founder pricing: $5/mo for the first 100 seats, then $9/mo. Locked for life, limited seats remaining. Run mailaccess pro for live availability.

Corpus contacts are live-only: they render in their own Pro surface and never touch your exports, local database, or history. If the service is unreachable, the harvest shows the full open result. Without a key, nothing changes.

Start with Pro → · how it works

Staying Up To Date

MailAccess checks PyPI for a newer release (cached, best-effort, never blocking) and prints an upgrade hint after a command when you're behind. Update in place with:

mailaccess upgrade

Silence the check with MAILACCESS_NO_UPDATE_CHECK=1. Prefer email? Get release notes in your inbox.

Modules

76 modules over a 5,300+ platform corpus. Investigations probe a bounded, evidence-first wave of the highest-signal platforms (~700 vetted by default) rather than the whole corpus. Full module reference in docs/modules.md.

ip_intel: enrich already-collected IPs with location, owner, risk flags and abuse contact using an optional ipgeolocation.io key. Configure with mailaccess ipgeo set-key; --no-ipgeo skips fresh calls and --refresh bypasses the 30-day cache. Free plans supply location and ASN; paid plans add company, security and abuse data.

API Keys

Most modules work with zero keys. Optional keys unlock more coverage. Full list in docs/api-keys.md.

Export Formats

Save reports as JSON, CSV, PDF, Markdown, STIX 2.1, or Maltego XML with -o. Full export reference in docs/exports.md.

Self-Hosting

Run the CLI locally or launch the full web stack with Docker Compose. Full guide in docs/self-hosting.md.

Links


Self-hosting guide	Docker Compose, `.env` reference, PostgreSQL, proxy/Tor, Maltego setup
Module reference	All modules, findings schema, adding new modules
False-positive controls	Common-name, disposable-domain, clustering, health, and scoring controls
API reference	REST endpoints, WebSocket events, authentication
Export formats	Supported formats, MIME types, filename conventions
Integrations	Maltego, Slack, Discord, generic webhooks
Brand assets	Logo lockups, palette, typography, clearspace, downloadable SVGs
Contributing	Adding modules, adding exporters, code style, PR checklist

License

MIT. All data queried by MailAccess comes from public sources. See DISCLAIMER.md for authorized use cases and legal responsibility.

If MailAccess saved you time, a ⭐ on GitHub helps other researchers find it.

Frequently asked questions

Is MailAccess free to use?

MailAccess is open source under the MIT licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does MailAccess do?

Free email OSINT tool, 5000+ platforms, identity clustering, breach detection. No API keys required. pip install mailaccess

What is MailAccess written in?

MailAccess is primarily written in Python. Its source is publicly available at https://github.com/KatrielMoses/MailAccess, and it has 1,612 GitHub stars.