nicholas-kloster/aimap

aimap is a network scanner written in Go that is purpose built for finding AI and machine learning services running on a network. It is described in the README as an nmap for AI infrastructure, where nmap is the classic general purpose port scanner. The point is that an ordinary scanner can see that something is listening on a port, but it will not tell you whether that something is a vector database, a private language model, or a Jupyter notebook left without a password. aimap tries to identify the specific AI service and, where possible, dig deeper to surface what is exposed. The intended users are two groups. The first is defenders inside an organisation, who run it against their own networks to find shadow AI deployments before attackers do. The README gives realistic examples: a data scientist running Ollama on a dev machine and forgetting to take it down, an MLflow instance accidentally bound to all network interfaces, a ChromaDB shipped to production without authentication, a Flowise install with OpenAI API keys in a world readable credentials panel. The second user group is the author's research project at nuclide-research.com, which runs the tool against authorised populations to map this kind of exposure at scale. The current release ships 121 service fingerprints across a wide list of categories: vector databases like Weaviate, ChromaDB, Qdrant, and Milvus, model servers like vLLM and Triton, agent platforms, observability tools, AI safety and evaluation tools, voice and audio models, medical imaging servers like Orthanc and dcm4chee, and even cross cutting checks for exposed vendor API keys for services like Anthropic, OpenRouter, and Stripe. About 50 of these services also have a deep enumerator that goes further and surfaces things like personal data fields, remote code execution paths, exposed credentials, and admin accounts that can be claimed. To keep scans fast, the tool offers named port profiles such as llm-gateway, vector-db, observability, healthcare, finance, and mcp, each of which narrows the scan to a hand picked list of ports relevant to that category. The author claims this gives a 5 to 10 times speedup compared to the default 51 port wide scan. There is also a companion Python tool called aimap-profile that does the opposite job: instead of identifying services on a target, it tries to classify the target itself as a personal device, institutional system, commercial host, research compute, or honeypot, and emits structured JSON. aimap is distributed as a single Go binary with no external dependencies, uses read only HTTP probes that the author says are safe to run against production, and is released under the MIT license. The repo currently sits at 3 stars.