Network Scanner MCP
Network discovery and port scanning for infrastructure mapping.
Part of the Agentic System - a 24/7 autonomous AI framework with persistent memory.
Environmental awareness for the AGI cluster through network device discovery, port scanning, and service detection.
Features
Device Discovery
ARP Network Scanning: Discover all devices on the local network
MAC Vendor Lookup: Identify device manufacturers
Hostname Resolution: Resolve device hostnames via reverse DNS
Device History: Track when devices first/last appeared
Anomaly Detection: Alert when unknown devices join
Port Scanning & Service Detection
Port Scanning: Scan specific ports or common service ports
Service Fingerprinting: Identify services by port and banner
Quick Scan Mode: Fast scan of common ports (22, 80, 443, etc.)
Full Port Scan: Comprehensive scan of ports 1-1024
Banner Grabbing: Capture service banners for identification
Cluster Monitoring
Cluster Node Status: Monitor AGI cluster node connectivity
Health Checks: Ping-based reachability testing with latency
Alert Daemon: Continuous monitoring with voice and cluster alerts
Node Recovery Detection: Alerts when nodes come back online
Alerting
Voice Alerts: TTS alerts via edge-tts
Node-Chat Integration: Broadcast alerts to cluster nodes
Alert History: Persistent alert log with history
Installation
Configuration
MCP Server Configuration
Add to ~/.claude.json:
Environment Variables
Variable | Default | Description |
|
| Data storage directory |
| Auto-detected | Network interface to use |
| Auto-detected | Default subnet for scans |
|
| Logging level |
|
| Enable file logging |
| None | JSON string of cluster nodes |
Alert Daemon Environment Variables
Variable | Default | Description |
|
| Seconds between scans |
|
| Enable voice alerts |
|
| Enable cluster alerts |
|
| Alert on new device detection |
|
| Alert when cluster nodes go offline |
|
| Voice for TTS alerts |
|
| Maximum alerts to retain |
Cluster Nodes Configuration
Create cluster_nodes.json in the data directory:
Or set via environment variable:
MCP Tools
Device Discovery
Tool | Description |
| ARP scan for all devices on subnet |
| Find only new devices since last scan |
| List unidentified devices |
Device Information
Tool | Description |
| Details about device (by IP or MAC) |
| Historical data for devices |
| Label a device as trusted |
| Remove device from known list |
Network Topology
Tool | Description |
| Full topology with categorization |
Port Scanning
Tool | Description |
| Scan ports on specific device |
| Quick scan all devices for services |
Cluster Monitoring
Tool | Description |
| Status of configured cluster nodes |
| Ping all nodes and report health |
Utilities
Tool | Description |
| Ping device for reachability |
| Resolve hostname via DNS |
| Get scanner status and configuration |
| Export IPs for security-scanner-mcp |
Usage Examples
Basic Network Discovery
Device Management
Port Scanning
Cluster Monitoring
Network Topology
Alert Daemon
The alert daemon provides continuous network monitoring with alerts.
Running the Daemon
Systemd Service
Install as a systemd service:
Check status:
Alert Types
Type | Trigger | Priority |
| Unknown device detected | High |
| Cluster node unreachable | Critical |
| Cluster node back online | Normal |
Data Storage
All data is stored in the configured data directory (default: ${AGENTIC_SYSTEM_PATH:-/opt/agentic}/databases/network-scanner/):
File | Description |
| All discovered devices with metadata |
| Devices marked as known/trusted |
| Cluster node configuration |
| Alert log (last 1000 alerts) |
| Queued alerts for delivery |
| MCP server logs (if enabled) |
| Alert daemon logs |
Integration
Enhanced Memory MCP
Device discoveries can be stored in enhanced-memory for pattern analysis and learning.
Node-Chat MCP
Alerts are broadcast to cluster nodes via node-chat when enabled.
Security Scanner MCP
Use export_for_security_scan() to get IP lists for vulnerability scanning with security-scanner-mcp.
Development
Running Tests
Code Structure
Requirements
Python 3.10+
Root/sudo access for ARP scanning
Network interface access
System Dependencies
arp-scan- Required for ARP scanningedge-tts- Optional for voice alertsmpv- Optional for audio playback
Changelog
v0.2.0
Added port scanning and service detection
Added hostname resolution
Implemented proper node-chat integration
Refactored with shared utilities module
Added comprehensive type hints
Added thread-safe device registry
Removed unused dependencies
Added unit tests
Fixed data format inconsistencies
Auto-detect network interface
v0.1.0
Initial release
ARP scanning
Device history tracking
Basic cluster monitoring
Alert daemon
Part of the AGI Agentic System - Environmental Awareness Component
Part of the MCP Ecosystem
This server integrates with other MCP servers for comprehensive AGI capabilities:
Server | Purpose |
4-tier persistent memory with semantic search | |
Persistent task queues and goal decomposition | |
Full AGI orchestration with 21 tools | |
Distributed task routing across nodes | |
Inter-node AI communication | |
Production-only policy enforcement |
See agentic-system-oss for the complete framework.