Xbox Friend Graph
Map, visualize, and explore any Xbox Live gamertag's social graph.
What it is
Xbox Friend Graph is a self-hosted web app that maps the social network of any Xbox Live gamertag as an interactive, visual graph. You start with a gamertag, choose how many degrees of friendship to explore, and the app crawls Xbox Live's social graph outward, friend by friend, building a force-directed visualization that updates in real time as it discovers new connections.
Every piece of data it collects is stored locally and persistently, making it both a live exploration tool and a long-term snapshot system, with a design that anticipates additional tooling built on top of the collected data.
A look inside
What it does
Social graph mapping
Enter any gamertag and crawl its friend network up to four degrees of separation, rendered as a real-time force-directed D3 graph that grows outward from the root as connections are found.
Depth-coded visualization
Each degree of friendship gets its own shade radiating from the root, and private profiles are flagged with a distinct fill, dashed outline, and lock icon so you can see who cannot be expanded.
Resumable crawls
A configurable node cap keeps API usage in check; when it is reached the crawl pauses and resumes exactly where it left off, with full crawl state checkpointed to disk.
Composable filters and search
Narrow the graph by played game and by gamerscore threshold, then search gamertags within what remains, with live updates, match counts, and arrow-key navigation.
Persistent snapshots
Every crawl is saved as GraphML for Gephi or NetworkX, and per-gamertag profile snapshots record friends and game history over time, updated in place on every visit.
Smart caching
Configurable friends and games cache windows avoid redundant Xbox Live API calls, and cache hits do not count against the node cap since no request is made.
OAuth access control
Microsoft account sign-in through Azure AD, an admin-managed allowlist with a pending queue, and per-account crawl history that is ownership-verified server-side.
Encrypted tokens
OAuth refresh tokens are encrypted at rest with Fernet, a required encryption key must be set before login is possible, and sessions use Flask's signed cookies.
Container-ready
Runs from a single Docker build and run, with data persisted through a mounted volume and every parameter tunable through environment variables.
Where it's going
Core crawler and live graph
ShippedMulti-degree Xbox Live crawling with a real-time D3 force-directed graph, composable filters, search, resumable crawls, GraphML export, OAuth access control, and encrypted tokens.
Full logout on unlink
In progressForce a fresh Microsoft account picker on unlink so it genuinely requires a new login instead of silently re-authenticating a cached account.
Deployment hardening
In progressReal TLS through a reverse proxy, a production WSGI server, hardened session cookies, and aggregate rate limiting across all users.
Multi-account sessions
PlannedConcurrent users with isolated sessions and crawl history that share the global profile cache, plus a per-session account switcher.
Snapshot viewer and crawl diffing
PlannedBrowse how a gamertag's friends and game library change over time from the stored snapshots, and diff two crawls to see nodes added, removed, or newly private.
Exports, scheduling, and analytics
PlannedExport filtered graphs to CSV, JSON, or SVG; schedule automatic re-crawls; and surface metrics like centrality, clustering, and shortest paths in the UI.