nybaywatch/agrusscannerWindows network reconnaissance scanner with ping sweeps, TCP port scanning, and deep AI/ML service detection for finding shadow AI, rogue LLM deployments, and GPU infrastructure.
Network reconnaissance tool with deep AI/ML service detection. Scans your network to discover hosts, open ports, and identifies AI services running across your infrastructure.
Built for security teams, IT admins, and researchers who need visibility into shadow AI, rogue LLM deployments, and GPU infrastructure on their networks.
There is a growing concern for shadow AI, and this provides a simple way to scan networks. Also many of the typical scanning tools for windows are slow and have poorly written interfaces, specifically for anyone running a 4k+ monitor. Agrus Scanner is built in native C#/.NET with WPF — no Electron, no embedded browser — so it launches fast, scans fast, and stays light on resources. I've been tired of trying to read tiny print so when a friend/client was looking for a way to scan for shadow AI, and without any windows type tool available, it seemed like a natural fit together.
It also works as a straightforward network scanner — ping sweeps, port scanning, and hostname resolution are all built in. You don't need a separate tool for basic recon. But where Agrus really stands out is AI detection: it goes beyond port scanning by actively probing discovered services with AI-specific API calls, pulling back model names, GPU details, container info, and version data. If someone on your network is running an AI service, Agrus finds it and tells you exactly what it is.
It also runs as an MCP server, so AI agents like Claude Code and OpenClaw can use it as a tool — scan networks, probe hosts, and pull back results autonomously. Point your agent at the endpoint and it handles the rest.
Download the latest installer from Releases, or directly:
AgrusScanner-Setup-1.0.6.msi — self-contained, no .NET runtime needed.
Also available on the Microsoft Store. Or visit the Tools page for the download link, checksum, and winget install command.
Requires Windows 10/11. The installer and the installed binaries are Authenticode-signed (Azure Trusted Signing, publisher Joseph Fago). Once installed, detection signatures keep themselves current; you only need a new installer when the app itself changes.
/v1/health's model_loaded field on its distinctive default port 13305trtllm-serve OpenAI-compatible server; identified via the hardcoded tensorrt_llm owned_by field on /v1/modelsdeepspeed-mii owned_by field on /v1/modelsMLC-LLM owned_by field on /v1/models/healthcheck on its distinctive default port 8585/site.webmanifest on its common default port 3000/manifest.webmanifest on its distinctive default port 3210submit_nochat_api route name on its Gradio /info endpoint