AgentSniff¶

AgentSniff is a Rust network scanner for discovering AI-agent infrastructure through passive observation, active probing, protocol detection, and signal fusion.

Quick start¶

cargo install agentsniff --locked
agentsniff scan 192.168.1.0/24
agentsniff serve --port 9090

The source workspace is at repository top level. The legacy Python implementation is retired.

AgentPin documents are reported as unsigned discovery evidence until AgentSniff implements the protocol's cryptographic verification profile. Detection datasets are separately signed and verified against a pinned repository key.

The dashboard binds to 127.0.0.1 by default. Non-loopback binding requires a strong AGENTSNIFF_API_TOKEN, which authenticates every non-health route; use TLS for remote access.

Guides¶

Guide	Description
Getting Started	Installation, verification, first scan, Docker
Detectors	Detection modules and confidence
CLI Reference	Commands and options
Dashboard	Dashboard and streaming
Configuration	YAML and environment settings
Alerting	Webhook and SMTP alerts
Integrations	Zeek, service enrichment, Nmap XML import
API Reference	REST and SSE endpoints
Architecture	Components and trust boundaries
Wazuh	SIEM integration