First public cut. L2/L3 recon and drift-watch for homelabs and proxmox fleets.
- discovery — arp-scan + kernel ARP cache, nmap ping/SYN, masscan pre-pass; passive mDNS / SSDP / WS-Discovery / NetBIOS
- identity — device classification, JARM / ssh-key / cert / favicon / http fingerprints with baseline drift alarms
- hunting — rogue-VM (hypervisor OUI), ARP-spoof (gateway-MAC pin), rogue-DHCP, ARP-conflict
- proxmox — cluster reconciliation (which VM owns this IP, invisible guests, unmanaged IPs), cert-pinned token
- risk — read-only container/BMC probes, KEV/EPSS-weighted scoring, testssl / nuclei / httpx orchestration
- ops — sqlite history + diff, query DSL, topology map (dot/mermaid/html), curses TUI, web dashboard, MCP bridge, prometheus/grafana/zabbix/ansible exports
Python stdlib, no pip. Degrades cleanly without root.