Home

Watchpost

Local-first, evidence-backed reviews of changes between saved Nmap scans.

Watchpost helps students and home-lab operators review networks they own or have permission to assess. It reads saved IPv4/TCP observations, compares compatible snapshots, and writes Markdown reports. It does not launch scans, upload data, or decide whether a network is secure.

Start here

Guide	What you will do
Getting started	Install from PyPI or the repository and run the offline demo
Reading reports	Separate explicit changes from missing observations
Scenarios	Practice expected deployment, backend exposure, and incomplete-scan reviews
Troubleshooting and safety	Resolve validation errors without weakening the evidence rules

The workflow

Saved earlier XML + saved later XML
                ↓
Validate completion, metadata, and port coverage
                ↓
Compare explicit observations
                ↓
Save a new Markdown report
                ↓
Human review against the intended access policy

The user confirms the same scan location, intended targets, and remaining scan settings. Matching XML metadata alone cannot establish those conditions.

Project status

Watchpost v0.0.1 is published on PyPI as watchpost-cli. See its GitHub release notes. It includes inspection, comparison, Markdown reporting, and the three synthetic walkthroughs.

This wiki is a guide to main. The repository README and version-controlled documentation are the source of truth. For a specific release, use the documentation at its tag, such as v0.0.1.

Core rule

Report what the evidence shows—not what you assume happened.

Missing observations are not confirmed closures. IP addresses are not device identities. Port numbers are not application identities. An observed change is not proof of vulnerability or compromise.

Run your first offline comparison →