Recon
Verify GitHub Archive repos and users via GraphQL
GraphQL enrichment and dedupe for archive repo and user CSVs.
Python · GPL-2.0 license
overview
What gh-enhancer does
gh-enhancer is the cleanup stage after archive harvest. It reads --repos-file and --users-file CSVs, confirms entries against the GitHub GraphQL API, and writes a folder of unique repositories and users.
Work runs in --batch-size chunks across --threads. Use --token for small runs, or --file-tokens to rotate credentials when one token nears its rate cap.
Trickest runs it as a managed Recon node between collectors (gh-downloader / gh-scraper) and gh-investigator. Feed noisy CSVs in; hand verified unique lists downstream.
use cases
Where gh-enhancer fits
Deduplicate a scraped GitHub Archive dump
Feed the raw repos and users CSV files from the scraper into gh-enhancer to collapse duplicate entries into one clean list per type.
Enrich repos and users through the GraphQL API
Confirm and enrich each entry against GitHub's GraphQL API in batches, dropping stale or invalid records before investigation.
Rotate across multiple GitHub tokens
Point --file-tokens at a list of tokens so large archives keep enriching across several credentials instead of stalling on one rate limit.
Prepare input for gh-investigator
Produce the clean repositories and users folder that the investigator stage reads to surface secrets, contributors, and other findings.
reference
gh-enhancer inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| repos-file | FILE | --repos-file | Path of the file containing the repos CSV files to process. |
| users-file | FILE | --users-file | Path of the file containing the users CSV files to process. |
| token | STRING | --token | GitHub token used for the API calls. |
| file-tokens | FILE | --file-tokens | File of GitHub tokens to rotate across for API calls. |
| batch-size | STRING | --batch-size | How many entries each GitHub GraphQL request asks for at once. |
| threads | STRING | --threads | Number of threads to run the enrichment with. |
Showing key inputs. gh-enhancer exposes 6 inputs in total.
example
Run gh-enhancer
# gh-enhancer: enrich and dedupe archive repos/users via GraphQL
gh-enhancer --repos-file repos.csv --users-file users.csv --token "$GITHUB_TOKEN" --batch-size 50 --threads 4https://github.com/example-org/web-frontend
https://github.com/example-org/payments-api
https://github.com/example-org/infra-terraform
https://github.com/example-dev/ci-runners
https://github.com/example-app/mobile-client
https://github.com/example-test/docs-site
https://github.com/example-net/edge-proxy
https://github.com/example-io/sdk-pythonguidance
Choosing gh-enhancer
Use gh-enhancer when you have raw repos and users CSVs from an archive scrape and need them deduplicated and verified before investigation. Collect first with gh-downloader or gh-scraper; mine findings afterward with gh-investigator.
gh-scraper
Upstream stage. Turns GitHub Archive URLs into the raw repos and users CSVs this node cleans.
gh-downloader
Sibling collector in the same toolkit. Pulls archive data down before enrichment runs.
gh-investigator
Downstream stage. Reads the enriched lists to surface interesting GitHub findings.
faq
gh-enhancer questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run gh-enhancer yourself
Raw archive CSVs feed gh-scraper, which passes scraped repos and users to GH Enhancer; it deduplicates and enriches them through the GraphQL API into a clean folder of unique lists.
Facts on this page come from the live Trickest tool library.