Reports

Every scan writes a report to the output directory, results/ by default (--output or "output_dir" in the configuration changes it). Files are named after the username, the level and the time:

results/someone_basic_20261107_120000.json

#Formats

Choose with --format, comma-separated, or "output_formats" in the configuration. Without either, only JSON is written.

Format	File	What it is
`json`	`.json`	Everything: every site, its status, confidence, HTTP code, timing and the detector's evidence. The format the other commands read back.
`csv`	`.csv`	One row per site and variation, for spreadsheets.
`html`	`.html`	A standalone page to open in a browser or send to someone.
`md`	`.md`	A Markdown summary of the Found and Maybe hits.
`pdf`	`.pdf`	An investigator's report with the profiles' avatars embedded. Needs the `pdf` extra.
`gexf`	`.gexf`	A graph for Gephi: username, profiles and, with `--correlate`, the clusters.
`mermaid`	`.mmd`	The same graph as a Mermaid diagram, for Markdown documents.
`maltego`	`_maltego.csv`	The graph as a CSV Maltego can import.
`all`		JSON, CSV, HTML and Markdown.

bash

aliens_eye someone --format json,html
aliens_eye someone --correlate --format all,gexf,pdf

--explain adds the evidence behind each verdict to the HTML and Markdown reports as well; the JSON report always carries it.

#The JSON report

json

{
  "scan_summary": {
    "base_username": "someone",
    "scan_level": "basic",
    "timestamp": "20261107_120000",
    "total_variations": 1,
    "total_sites_scanned": 7710,
    "total_found": 42,
    "total_high_confidence": 30,
    "best_variations": [["someone", 42]]
  },
  "variations": {
    "someone": {
      "scan_info": {
        "username": "someone",
        "sites_scanned": 7710,
        "found": 42,
        "maybe": 97,
        "not_found": 7301,
        "errors": 211,
        "skipped": 59,
        "high_confidence_matches": 30
      },
      "sites": {
        "github": {
          "status": "Found",
          "code": 200,
          "url": "https://github.com/someone",
          "final_url": "https://github.com/someone",
          "response_time": 0.41,
          "confidence": 93,
          "ai_analysis": { "…": "features, scores, checks, profile details" }
        }
      }
    }
  }
}

The numbers above are illustrative. Each username tried (one per variation) has its own entry under variations. ai_analysis holds the detector's working: the features, both judges' scores, the checks applied to a Found and, where a profile was read, its display name, bio and avatar.

A scan with --correlate adds a top-level correlation object with the clusters, and one with --domains adds domains.

With --only-found, sites keeps only Found and Maybe entries; the counts in scan_info still describe the whole scan.

#Reading a report back

bash

aliens_eye -r results/someone_basic_20261107_120000.json            # the result tables
aliens_eye -r results/someone_basic_20261107_120000.json --explain  # with the evidence
aliens_eye diff old.json new.json                                   # what changed
aliens_eye label results/someone_basic_20261107_120000.json         # label the Maybes

The MCP server's read_report tool reads the same files.

#Treat it as sensitive

A report about a real person is personal data: it ties their accounts together in one place. Keep reports somewhere private, share them only with people who need them, and delete them when the work is done.