ArcSwordKiln/osint-people-checker

Marlowe is a desktop OSINT checker for people who want a quick read on someone they are about to deal with — a marketplace seller, recruiter, landlord, or shop — before handing over money, personal details, or keys. You type a nickname, email, phone number or link, pick a context, and it returns one of three verdicts (Looks fine, Be careful, Red flags) with three plain-worded reasons, each tied to a saved copy of the page it came from README.

What it actually does

The tool reads a set of public, keyless sources. Site checks (packaged as one TOML entry per site in the sources directory) test whether accounts exist under a name and when they were created. RDAP/WHOIS, certificate logs, the Wayback Machine, DNS-over-HTTPS and public profiles (Gravatar, GitHub, Bluesky, Mastodon) cover domain age, site history, email setup and linked identities README.

The distinguishing mechanism is the evidence trail: each page is snapshotted locally at discovery time, with a UTC timestamp and a SHA-256 hash, and a public Wayback copy is made by default README. That turns findings into something you can show a marketplace, bank or police. A "Keep digging" mode follows up to three steps and labels why each branch was taken, and a single timeline lines up account creation, domain registration and listing dates.

What changes in a workflow

Instead of opening many tabs and guessing, you run one check and get a verdict plus receipts you can click. Verdicts are generated by a local Ollama model, or by plain rules if you prefer; nothing leaves the PC unless you deliberately select an online model in Settings README. An optional "Check yourself" mode shows what is public about you, with opt-out links, and can produce a PDF report. Watches expire after 90 days unless renewed.

Requirements and limits

• Windows only for the ready-made build. The release zip is for Windows 10/11, portable, needs no admin rights, and must keep Main.exe alongside the marlowe runtime README.
• Building from source needs Rust 1.85+ and the Tauri prerequisites for your system README.
• No accounts or keys needed for the core checks; searching Have I Been Pwned by email requires your own optional HIBP key README.
• Deliberate exclusions: no home-address or live-location lookup, no face recognition of strangers, no logging into accounts or reading anything behind a login, no password-reset probing, and no watching of private individuals README.
• Not for screening decisions. The author explicitly warns it is not a consumer reporting agency and must not be used to screen tenants or job applicants, or for credit, insurance or employment decisions (FCRA in the US) README.
• Privacy: cases are stored locally, but the Wayback archive copies are public unless turned off in Settings README.
• Legality depends on use: in the EU/UK, investigating on someone else's behalf makes you the data controller, required to have a legitimate reason and keep only what is needed README.

HotRepo's take

The repository is MIT-licensed and had 103 total stars when it appeared on the NEW-REPOSITORY board on 2026-10-31 repository; the available board history is too thin to say anything about momentum. The README is unusually specific about what the tool will not do and where its legal boundaries are, which is the most useful signal for judging fit here.