Content
# AgentScan
[English](README_en.md) | English
> A one-command inventory of exposed surfaces for MCP, A2A Agent Card, and LLM open interfaces.
[](https://go.dev)
[](https://github.com/7anX/AgentScan/stargazers)
[](LICENSE)
Traditional port scanners only tell you "there's an HTTP service here". AgentScan goes one step further: it checks if the service is MCP, A2A Agent, or an open LLM interface, and outputs available tools, agent capabilities, model lists, and authentication status.
## What Can Be Scanned
| Protocol | Identified Content |
| --- | --- |
| MCP Server | Streamable HTTP, HTTP+SSE legacy, tool/resource/prompt list, authentication status, honeypot signals |
| A2A Agent | Agent Card, skills, interfaces, un-authenticated JSON-RPC reachability, private IP address leakage |
| LLM Open Interface | Ollama, vLLM, SGLang, TGI, llama.cpp, Xinference, LiteLLM, FastChat, LocalAI, LM Studio, LMDeploy |
## Quick Start
**Linux / macOS (compiled from source)**
```bash
git clone https://github.com/7anX/AgentScan
cd AgentScan
go build -o agentscan .
# Scan a domain or IP
./agentscan scan example.com
# Scan a private IP segment
./agentscan scan 192.168.1.0/24
# Skip port scanning and directly verify known host:port
./agentscan scan -f targets.txt --skip-port-scan
```
**Linux Precompiled Binary (no Go environment needed)**
```bash
# amd64
curl -L https://github.com/7anX/AgentScan/releases/latest/download/agentscan_linux_amd64.tar.gz | tar xz
chmod +x agentscan && sudo mv agentscan /usr/local/bin/
# arm64 (Raspberry Pi, ARM cloud server)
curl -L https://github.com/7anX/AgentScan/releases/latest/download/agentscan_linux_arm64.tar.gz | tar xz
chmod +x agentscan && sudo mv agentscan /usr/local/bin/
```
**Windows**
```powershell
go build -o agentscan.exe .
.\agentscan.exe scan example.com
```
## Commands
```text
agentscan scan # Full protocol scanning for MCP + A2A + LLM (most commonly used)
agentscan mcp # Scan only MCP
agentscan a2a # Scan only A2A Agent Card
agentscan llm # Scan only LLM open interfaces
```
Common parameters:
```text
-f, --file FILE Read targets from file (one per line)
-T, --threads N TCP scanning concurrency, default 500
--timeout MS TCP timeout, default 2000ms
--skip-port-scan Input as open host:port
--proxy URL socks5/socks4/https/http proxy
-o, --output FILE Write JSON; A2A/LLM automatically write _a2a.json / _llm.json
-v, --verbose Display detection details
```
## Combined Usage
```bash
# masscan discovers ports, AgentScan performs AI protocol identification
masscan 10.0.0.0/8 -p 80,443,8000,8080,11434 --rate 100000 -oL open_ports.txt
awk '/open/ {print $4 ":" $3}' open_ports.txt > targets.txt
agentscan scan -f targets.txt --skip-port-scan
# Secondary verification of mapping platform results
agentscan scan -f fofa_export.txt --skip-port-scan --mcp-threads 200
```
## Blog
- [Security issues with exposed MCP surfaces](https://7anx.github.io/security-research/mcp-attack-surface/)
- [Security issues with exposed A2A surfaces](https://7anx.github.io/security-research/a2a-attack-surface/)
- [AgentScan usage instructions](https://7anx.github.io/agentscan/agentscan-use-cases/)
- [AgentScan architecture](https://7anx.github.io/agentscan/agentscan-architecture/)
## Community
This project is open-sourced and promoted in the [LINUX DO](https://linux.do) community.
## Disclaimer
This tool is only for legally authorized enterprise security construction. Ensure you have obtained authorization and comply with local laws and regulations before using it. The author is not responsible for any consequences of unauthorized use.
## Sponsors
Thanks to the following security communities for their support:
<table>
<tr>
<td align="center">
<img src="docs/yunkunlab.jpg" alt="Yunkun Security Lab" width="120"><br>
<b>Yunkun Security Lab</b>
</td>
</tr>
</table>
MCP Store