GitHub, GitLab & Mastodon Username Lookup

Check a supplied username account across GitHub, GitLab, and Mastodon, then export matched public profile URLs, platform identity, account state, and visible metadata. The Actor turns repeatable OSINT account discovery into structured JSON, CSV, Excel, or API output.

It is designed for focused investigations on three developer and federated-social platforms. It does not claim to search every website, infer that accounts belong to the same person, recover credentials, or access private data.

What does this username lookup do?

For each supplied username, the Actor can:

• look up the corresponding public GitHub account;
• find an exact public GitLab username;
• check one or more public Mastodon instances;
• accept name@instance.social for a precise Mastodon lookup;
• normalize identity, profile, biography, count, and timestamp fields;
• preserve an optional not_found audit row for every completed check;
• retain successful checks when another upstream lookup fails, with optional uncharged error audit rows; all-failed runs still fail;
• export results through the default Apify dataset.

The implementation uses the platforms' public account APIs. It does not open browsers, use residential proxies, or call AI models. Supplied handles are sent only to the selected public service; this Actor keeps no cache or independent copy beyond the per-run Apify dataset and logs, whose retention and deletion you control through Apify.

Who is this username account finder for?

Trust and safety analysts

Check a reported handle against developer and federated platforms and retain source URLs for review.

Fraud and abuse investigators

Build an initial public account footprint before deeper, authorized research. A match is a lead, not proof of common ownership.

Open-source intelligence researchers

Schedule the same bounded account checks and compare exported records in a database or spreadsheet.

Developer relations and security teams

Resolve public GitHub and GitLab identities, repository counts, visible biographies, and canonical profile links.

Supported platforms

Platform	Lookup scope	Useful public fields
GitHub	github.com public API with a rate-aware public profile fallback	Profile URL, public identity, avatar, location, website, followers, following, and repositories; API-only fields can be null during fallback
GitLab	gitlab.com exact username query	Profile URL, name, state, bio, location, website, avatar, visible activity dates
Mastodon	User-selected public instances	Profile URL, display name, account state, bio, website field, followers, following, creation and latest-status dates

Mastodon does not have a global username namespace. alex@mastodon.social and alex@fosstodon.org are different accounts. For a plain username, the Actor checks every entry in mastodonInstances.

What data is extracted?

Field	Meaning
username	Canonical platform username, or checked value for a not-found row
platform	github, gitlab, or mastodon
instance	Mastodon server hostname; null for GitHub and GitLab
found	Whether a matching public account was returned
accountState	Visible state such as active, blocked, suspended; not_found means confirmed absence and error means the lookup could not be verified
errorReason	Upstream failure explanation on optional error rows; absent on normal rows
accountId	Public platform identifier when available
profileUrl	Canonical public profile link
displayName	Public display name
bio	Visible biography; Mastodon HTML is converted to text
avatarUrl	Public avatar image URL
location	Visible location when provided
website	Visible profile website or homepage
followersCount	Public follower count when exposed
followingCount	Public following count when exposed
repositoriesCount	Public repository count, currently available for GitHub
createdAt	Visible account creation timestamp or date
lastActivityAt	Latest visible profile update, activity, or status date
sourceUrl	Public API URL used for the check
checkedAt	UTC timestamp for the completed lookup

Fields unsupported or hidden by a platform are returned as null. Counts and profile metadata are observations from the check time and may change later.

How to find username accounts

1. Open the Actor in Apify Console.
2. Add one or more values to Usernames.
3. Select GitHub, GitLab, Mastodon, or any combination.
4. If checking Mastodon, keep mastodon.social, add other instances, or use name@instance inputs.
5. Enable Include accounts not found only when your audit needs completed-check evidence.
6. Set Maximum saved results to bound dataset output.
7. Click Start.
8. Open the Dataset tab and export JSON, CSV, Excel, XML, or RSS.

A useful first input is:

{
  "usernames": ["octocat", "Gargron@mastodon.social"],
  "platforms": ["github", "gitlab", "mastodon"],
  "mastodonInstances": ["mastodon.social"],
  "includeNotFound": false,
  "maxResults": 20
}

Input parameters

Input	Type	Default	Description
usernames	string array	required	One to 100 names. A leading @ is accepted. Use name@instance for one explicit Mastodon server.
platforms	string array	all three	Platforms to check. Values are github, gitlab, and mastodon.
mastodonInstances	string array	mastodon.social	Up to 10 public server hostnames used for plain usernames.
includeNotFound	boolean	false	Save confirmed absence and failed-check audit rows; error rows never count as verified absence.
maxResults	integer	20	Save at most 1–1,000 result rows after completing requested checks.

A run can request at most 100 combined platform checks. maxResults caps saved rows after all selected lookups, not network requests: maxResults=1 can still make 100 checks. Each username/platform pair is one check, and each Mastodon username/instance pair is one check. Inputs above that hard limit fail before any API request or start charge. Duplicate input values and platform selections are removed. Invalid usernames and Mastodon hostnames fail before requests. An upstream failure does not discard successful checks; if every check fails, the run fails rather than reporting a false empty success.

Output example

A current GitHub match has this normalized shape (some values shortened for readability):

{
  "username": "octocat",
  "platform": "github",
  "instance": null,
  "found": true,
  "accountState": "active",
  "accountId": "583231",
  "profileUrl": "https://github.com/octocat",
  "displayName": "The Octocat",
  "bio": null,
  "avatarUrl": "https://avatars.githubusercontent.com/u/583231?v=4",
  "location": "San Francisco",
  "website": "https://github.blog",
  "followersCount": 20000,
  "followingCount": 9,
  "repositoriesCount": 8,
  "createdAt": "2011-01-25T18:44:36Z",
  "lastActivityAt": "2025-11-22T12:23:27Z",
  "sourceUrl": "https://api.github.com/users/octocat",
  "checkedAt": "2026-08-14T14:20:00.000Z"
}

Live counts and timestamps can differ. Exported rows always follow the dataset schema available in the run.

How much does it cost to find username accounts?

The Actor uses pay per event:

• Start: $0.005 once per accepted run, covering up to the hard limit of 100 platform checks, including checks that return no match.
• Username account record: tiered by your Apify plan. The BRONZE reference price is $0.010324 per saved matched or requested not-found row.

At the BRONZE tier, calculate a run as the $0.005 start event plus the number of saved records multiplied by the $0.010324 record event. For example, a five-record run consists of one start event and five record events. A 100-check run with no matches and includeNotFound=false costs only the $0.005 start event because the bounded lookup work is included in that event. Your active Apify subscription determines the exact record tier.

Checks with no match are omitted unless the not-found audit option is enabled. Every saved match or confirmed-absence row uses the username account record event. Failed-check error rows (available only with includeNotFound=true) are not profile-charged. The one-time start event still covers bounded lookup work, including failures. Unsaved checks have no profile charge.

Tips for reliable OSINT account discovery

• Use exact known handles rather than names with spaces.
• Add only Mastodon instances relevant to the investigation.
• Use name@instance when the server is known; it avoids unnecessary instance checks.
• Keep includeNotFound off for a matches-only lead list.
• Enable it for recurring audits where absence evidence is important.
• Store checkedAt with every comparison; public profiles change.
• Treat matching handles as hypotheses. Confirm ownership with independent evidence.
• Split very large recurring lists into bounded runs to stay within anonymous API limits.

Scheduling and change monitoring

Apify schedules can run the same input hourly, daily, weekly, or monthly. Send each completed dataset to your own table, warehouse, or webhook and compare stable keys such as:

platform + instance + username

Useful changes include a newly found account, an account state change, a profile URL change, or updated visible counts. The Actor does not maintain history or send change alerts itself; Apify schedules and integrations provide the automation trigger.

Export and integration workflows

Spreadsheet review

Export the dataset as CSV or Excel, then filter by platform, found, or accountState.

Trust and safety queue

Send matched records to a webhook and route profile URLs to an analyst. Keep the Actor's result as public-source evidence, not an automated identity verdict.

Data warehouse

Append rows by checkedAt, then build a latest-state view keyed by platform, instance, and username.

Make, Zapier, and n8n

Use the Apify integration to start a task, wait for completion, and consume dataset items in downstream steps.

Run with the Apify API

Replace YOUR_TOKEN with an Apify API token stored securely.

cURL

curl -X POST \
  "https://api.apify.com/v2/acts/automation-lab~cross-platform-username-discovery/run-sync-get-dataset-items?token=YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "usernames": ["octocat"],
    "platforms": ["github", "gitlab", "mastodon"],
    "mastodonInstances": ["mastodon.social"],
    "maxResults": 10
  }'

JavaScript

import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: process.env.APIFY_TOKEN });
const run = await client.actor('automation-lab/cross-platform-username-discovery').call({
  usernames: ['octocat', 'Gargron@mastodon.social'],
  platforms: ['github', 'gitlab', 'mastodon'],
  mastodonInstances: ['mastodon.social'],
  includeNotFound: false,
  maxResults: 20,
});
const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items);

Python

import os
from apify_client import ApifyClient

client = ApifyClient(os.environ['APIFY_TOKEN'])
run = client.actor('automation-lab/cross-platform-username-discovery').call(run_input={
    'usernames': ['octocat'],
    'platforms': ['github', 'gitlab', 'mastodon'],
    'mastodonInstances': ['mastodon.social'],
    'includeNotFound': False,
    'maxResults': 10,
})
items = client.dataset(run['defaultDatasetId']).list_items().items
print(items)

For production automation, start runs asynchronously and inspect terminal status before reading the dataset.

Use with Apify MCP

Add the Actor to Claude Code:

claude mcp add --transport http apify \
  "https://mcp.apify.com?tools=automation-lab/cross-platform-username-discovery"

Claude Desktop setup

Add this server object to the Claude Desktop MCP configuration:

{
  "mcpServers": {
    "apify": {
      "url": "https://mcp.apify.com?tools=automation-lab/cross-platform-username-discovery"
    }
  }
}

Cursor setup

Open Settings → MCP → Add server, choose HTTP, and use:

https://mcp.apify.com?tools=automation-lab/cross-platform-username-discovery

VS Code setup

Add the same HTTP URL as an MCP server in your workspace or user MCP configuration, then authorize Apify when prompted.

Example prompts:

• “Check octocat on GitHub, GitLab, and mastodon.social. Return only matched profile URLs.”
• “Create an audit dataset for torvalds and Gargron@mastodon.social, including not-found checks.”
• “Run the username account lookup weekly and summarize profile-state changes from my stored datasets.”

Limits and failure behavior

• Coverage is limited to GitHub.com, GitLab.com, and the requested Mastodon instances.
• GitHub and GitLab self-managed installations are not supported.
• Mastodon servers may be offline, private, blocked, or API-incompatible.
• Anonymous public APIs enforce their own rate limits. If GitHub's API returns HTTP 403 or an exhausted HTTP 429, the Actor makes one bounded lookup through the corresponding public profile page.
• A blocked or malformed GitHub fallback is never reported as not_found; a GitHub HTML 404 also needs recognizable not-found content. API identity and canonical profile URL must match the requested handle.
• Persistent GitLab/Mastodon rate limits, server errors, malformed responses, unexpected identities or content types fail that check. Verified checks survive; includeNotFound=true exposes an uncharged error row with errorReason, source URL and check time. A run with no verified checks fails.
• Mastodon hostnames must resolve exclusively to public addresses, the resolved address is pinned for the HTTPS connection, and redirects are refused.
• The Actor retries transport, 429, and selected temporary 5xx errors twice with bounded backoff.
• The Actor does not use a proxy, login, CAPTCHA service, browser, or private API.
• maxResults limits saved rows, not requested checks; the selected usernames, platforms, and Mastodon instances must independently produce no more than 100 checks.
• Inputs above 100 combined checks fail before any public API request or start charge.
• Public APIs can omit fields or expose platform-specific date precision.

Responsible and legal use

This Actor accesses public account endpoints. Use it only for lawful purposes and follow platform terms, applicable privacy law, employment rules, and organizational policies.

Do not use a shared username as proof that accounts belong to one person. Do not use the output for harassment, stalking, credential attacks, password recovery, impersonation, or decisions that require verified identity. Apply data minimization, access controls, retention limits, and human review to investigation datasets.

You are responsible for the input, processing purpose, downstream use, and deletion policy.

Troubleshooting

Why did the run fail instead of returning not found?

A documented absence is different from an upstream error. The Actor returns not_found only after a verified absence response. Failed checks do not erase successful results. Enable includeNotFound to see separate, uncharged error audit rows; if every check fails, the run fails.

Why was a Mastodon account not found?

Confirm the server. A plain username checks only mastodonInstances; it does not search every federated server. Prefer name@instance.social when you know the full handle.

Why is a GitLab field null?

GitLab's anonymous public user search returns a smaller field set than authenticated endpoints. The Actor reports only what the public response provides.

Can this find a Gmail account or password?

No. Search demand sometimes associates “username account” with Gmail, passwords, or recovery, but those are unsupported and unsafe equivalences. This Actor only checks the three documented public profile platforms.

Does a matching handle prove common ownership?

No. Usernames can be shared, copied, recycled, or impersonated. Use profile content and independent authorized evidence before drawing conclusions.

FAQ

Does the Actor need credentials?

No. It uses anonymous public endpoints. GitHub API rate pressure activates a bounded public profile-page fallback, while blocked lookups fail closed rather than becoming false not-found results.

Can I check multiple Mastodon instances?

Yes. Add up to 10 hostnames to mastodonInstances. An explicit name@instance input checks only that instance for Mastodon while still using name for selected GitHub and GitLab checks.

Are not-found rows charged?

Only when the not-found audit option is enabled. Every saved match or confirmed-absence row uses the profile event. Error audit rows are not profile-charged. Unsaved not-found checks are covered by the one-time start event and the hard limit of 100 platform checks per run.

Can I export CSV or Excel?

Yes. Open the default dataset and choose JSON, CSV, Excel, XML, or RSS.

Does it download avatars?

No. The Actor stores the public avatar URL but does not download image files.

Can I search more than 100 usernames?

One run accepts up to 100. Split larger lists into bounded tasks or API calls and merge results downstream.

Related automation-lab Actors

• Social Media Profile Finder extracts social links already published on supplied websites.
• Phone Number OSINT Scanner normalizes authorized phone numbers and gathers public footprint signals.
• GitHub Contributors Scraper exports public repository contributor records for developer-community research.

Use this Actor when the starting point is a username. Use Social Media Profile Finder when the starting point is a website, and use source-specific Actors when the investigation begins with a repository or phone number.

Support

For a reproducible problem, include the run ID, sanitized input, affected platform or Mastodon instance, expected behavior, and observed status. Do not include passwords, tokens, private account data, or unnecessary personal information.