v0.2.0 — sweep, hardening audit, close-out

Surveys can now sweep an address range, check a configuration against vendor hardening guidance, and be closed out properly. Both new capabilities are gated the way the read-only promise always was: in code, with tests, and with no override flag.

Added

Authorised subnet sweep and port scan (netwalk_sweep.py) — the crawl finds what announces itself; the sweep finds the static-address server, the forgotten printer and the second firewall nobody remembers. A refused connection counts as a host found. ~68 well-known TCP ports by default, and the ones that are a finding on their own carry a stated reason.

Third promise: netwalk never sweeps a range nobody authorised. A range must be in the site's scope with the name of the person who authorised it, which then appears in the report. Outside the scope: refused. A supernet of an authorised range: refused. Public address space without a second explicit flag: refused. Larger than a /16: refused. There is no --force, and a test asserts there never will be.

Hardening catalogue (netwalk_audit.py) — 38 checks as data, so the same checks run on every site instead of depending on anyone remembering them. It reads configuration exports off the disk, so a config full of PSKs never passes through a model. NOT CHECKED is part of the output: anything that could not be decided is listed by name and written into the report's coverage section.

Closing a survey out — forget --with-configs shreds the configuration exports as well as the credential store; without the flag it tells you how many are still there. The full report now names where the survey left its sensitive files.

Fixed

• A community string reached a delivered report. The renderer refuses to build a report from a record holding credential material — except its pattern was anchored on the word snmp, so trap-community: <value> walked past it. Fixed, tested in both directions, and the test was verified by reinstating the old pattern and watching it fail.
• The audit reported one host twice and dropped findings silently — findings were emitted per sweep rather than per host, and shared a fixed id that the writer then deduplicated away.
• MikroTik checks matched only one of two RouterOS output shapes, so telnet, ftp, www, api and the default admin account silently passed on every real site.
• A hardening check that reads one setting no longer overrules a conclusion someone verified against the firewall.

Tests

651 cases, up from 341.

Full detail in CHANGELOG.md · compare v0.1.0...v0.2.0

v0.1.0 — first public release

A read-only network survey toolkit that ships as six Claude Code skills and works from a plain terminal without an agent at all.

Two promises, enforced in code — not by a prompt asking the model nicely:

1. It never changes anything. Every command is checked against a per-vendor read-only allowlist before it is sent.
2. Credentials never touch the conversation. They are typed into a one-shot page served on your own 127.0.0.1, written to a 0600 file, and read by the exec wrapper. The assistant is told the path, never the value.

What is in it

• Six skills: netwalk, netwalk-login, netwalk-scan, netwalk-diag, netwalk-map, netwalk-fullreport
• Read-only command packs for MikroTik, Cisco, ArubaOS-CX, HP ProCurve & Comware, FortiOS, Junos, Linux and Windows — an unknown vendor falls back to a show/display/get/print-only profile rather than being unsupported
• Controller adapters for UniFi and TP-Link Omada, so an adopted estate is read in one pass instead of device by device
• Deterministic SVG topology diagram and a self-contained HTML report with a --public mode
• install.py --agent for Cursor, Windsurf, Cline, Copilot, Gemini CLI, Continue, Aider and Codex

Tested end to end against a live customer site during development, which found eleven defects the unit tests could not see — the diagram, the report and the credential form all had faults only visible in the rendered artefact. Every one has a regression test.

Python 3.9+, standard library only.