Voyager Net MCP server

voyager-net

Voyager's network organ — a safe, read-only, authorized audit of one host or domain you own, so an AI agent can find the falle in your infra and describe the fix.

Voyager penetrates the web (@dir-ai/voyager), the repo (@dir-ai/voyager-repo), and — here — networks. This is the sense: it finds problems. Applying fixes ("the hands") is a separate, consent-gated organ, by design — an AI must never mutate live infrastructure on its own.

voyager-net scan yourhost.example.com --authorized
voyager-net scan 10.0.5.20 --authorized --ports 22,80,443,5432

What it checks (read-only)

resolved a single time and the DNS, port, TLS and HTTP probes are all pinned to that one IP via a custom socket lookup, so nothing re-resolves the name mid-scan (closes the HTTP DNS-rebinding path). The resolved IP is classified canonically (via ipaddr.js) and any non-public address — loopback, private, link-local, CGNAT, NAT64, IPv4-mapped IPv6, metadata — is refused.

• Resolve-once + IP pinning (every probe, HTTP included) — a domain is

SPF +all (anyone may send) and DMARC p=none (no enforcement) are findings, not just presence checks. All target-controlled records are injection-framed.

• DNS — A/AAAA/MX/TXT/CAA + email/CA hygiene, and it grades the content:

states (open / closed / filtered / unreachable — an OS timeout reads as filtered*, not closed), no SYN tricks, no payloads, no range/CIDR sweeps.

• Ports — a bounded common-service probe by plain TCP connect() with **real

(SSH, SMTP, FTP, POP3, IMAP) to identify product + version (framed).

• Service fingerprinting — reads the banner a service volunteers on connect

Memcached, Elasticsearch, CouchDB, Docker API, ZooKeeper) it sends ONE benign, read-only protocol hello (e.g. Redis PING) and reports the service as exposed only if it answers without asking for credentials. Honest scope: this and the TLS/HTTP inspectors DO send bytes (a ClientHello, a GET /, a protocol hello) — the audit is active-but-safe (no writes, no mutation, no exploit), not purely passive, and it runs only against the host you authorized.

• Unauthenticated-service detection — for auth-expecting services (Redis,

negotiated one), chain trust against the system store (any validation failure is reported, not only self-signed), RSA key size (EC/EdDSA exempted), certificate expiry/issuer.

• TLS — the full set of accepted protocol versions (not just the

max-age, unsafe-inline/wildcard — not just presence), clickjacking protection, per-cookie Secure/HttpOnly (each cookie evaluated on its own), CORS wildcard and the dangerous credentials-with-origin case, version-leak, and HTTP→HTTPS redirect. All pinned to the vetted IP.

• HTTP hygiene (graded) — status, Server banner, HSTS/CSP quality (weak

reported as UNKNOWN, never folded into a "no issues" verdict.

• Honest partial — an open TLS/HTTP port that couldn't be inspected is

Findings that name a detected service+version suggest checking it against a CVE feed — voyager-net detects the version; CVE matching stays a lookup, and CVE probing (Nuclei &c.) is out of scope — that is active testing, a separate, more-gated capability, not a read-only sense.

Each finding carries a severity, confidence, and a described fix — e.g. "certificate expires in 6d → renew and automate ACME", "mysql reachable publicly → restrict to a private network", "no DMARC → publish v=DMARC1; p=quarantine".

Safety — non-negotiable

Shortened. The full README is on GitHub.