AgrusScanner
Windows network scanner that finds AI/ML services and MCP servers on your network (shadow AI discovery). Signed, self-updating detection signatures. Runs as an…
- Transport
- Not stated
- Package
- —
- Registry id
- —
No install snippet on purpose. A working MCP config is a command, its arguments and an environment block — the last two are where API keys live, so this catalogue never stores them and cannot publish them. Follow the link above for the authors' own instructions.
Network reconnaissance tool with deep AI/ML service detection. Scans your network to discover hosts, open ports, and identifies AI services running across your infrastructure.
Built for security teams, IT admins, and researchers who need visibility into shadow AI, rogue LLM deployments, and GPU infrastructure on their networks.
Why
There is a growing concern for shadow AI, and this provides a simple way to scan networks. Also many of the typical scanning tools for windows are slow and have poorly written interfaces, specifically for anyone running a 4k+ monitor. Agrus Scanner is built in native C#/.NET with WPF — no Electron, no embedded browser — so it launches fast, scans fast, and stays light on resources. I've been tired of trying to read tiny print so when a friend/client was looking for a way to scan for shadow AI, and without any windows type tool available, it seemed like a natural fit together.
It also works as a straightforward network scanner — ping sweeps, port scanning, and hostname resolution are all built in. You don't need a separate tool for basic recon. But where Agrus really stands out is AI detection: it goes beyond port scanning by actively probing discovered services with AI-specific API calls, pulling back model names, GPU details, container info, and version data. If someone on your network is running an AI service, Agrus finds it and tells you exactly what it is.
It also runs as an MCP server, so AI agents like Claude Code and OpenClaw can use it as a tool — scan networks, probe hosts, and pull back results autonomously. Point your agent at the endpoint and it handles the rest.
Install
Download the latest installer from Releases, or directly:
AgrusScanner-Setup-1.0.2.msi — self-contained, no .NET runtime needed.
Also available on the Microsoft Store. Or visit the Tools page for the download link, checksum, and winget install command.
Requires Windows 10/11. The installer and the installed binaries are Authenticode-signed (Azure Trusted Signing, publisher Joseph Fago). Once installed, detection signatures keep themselves current; you only need a new installer when the app itself changes.
What's New
v1.0.2 — September 2026 (current)
- MCP tool-name enumeration (opt-in) — a new setting, List tool names on detected MCP servers, follows a successful handshake with a read-only
tools/liston the same session and shows the exposed tool names in the result (for exampletools: read_file, write_file, query). That is what tells you a rogue listener has filesystem or database reach. Off by default; the scanner still never invokes a tool. - The signature feed is now fetched through
downloads.jpftech.cominstead of GitHub directly.
v1.0 — September 2026
Agrus Scanner 1.0 is the first stable release. The detection engine, the signed signature feed, and the MCP integration are complete and supported. From here on, new AI services are delivered as signature updates and the app version only changes when the engine, UI, or MCP tools change.
From the project's README.