Local-first network reconnaissance. One binary, deterministic output, and a diff that tells you what changed since the last scan.
cortex scan --ports 22,80,443,5432,6379,8443 --evidence full 10.20.0.0/24
Planned interface The command above is the designed v1 CLI. It does not run today.
Recorded fixture Illustrative recorded-format fixture for the finished Cortex model, from a purpose-built lab network. Not output from today's engine.
| 00000000 | 474554202f20485454502f312e300d0a | GET / HTTP/1.0.. |
|---|---|---|
| 00000010 | 0d0a | .. |
GET / HTTP/1.0\r\n\r\n
| 00000000 | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d | H T T P / 1 . 1 2 0 0 O K . |
|---|---|---|
| 00000010 | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 | . S e r v e r : n g i n x / 1 |
| 00000020 | 2e 32 37 2e 32 0d 0a 44 61 74 65 3a 20 54 75 65 | . 2 7 . 2 . . D a t e : T u e |
HTTP/1.1 200 OK\r\nServernginx/1.27.2.2\r\nDate: Tue, 25 Aug 2026 09:14:16 GMT\r\nContent-Type: text/html\r\nContent-Length: 615\r\nLast-Modified: Thu, 21 Aug 2026 08:31:09 GMT\r\nConnection: close\r\nETag: "68b0a4f7-267"\r\nAccept-Ranges: bytes\r\n\r\n<!DOCTYPE html>\n<html>\n<head>\n<title>Welcome to nginx!</title>\n
248 further bytes held in the evidence store.
Cortex is a privately developed tool, so it will arrive as a built artifact rather than as something you assemble yourself. That artifact does not exist yet, and this section is careful not to imply otherwise.
There is no download. No binary has been produced, signed or published anywhere, and the engine does not yet build cleanly at the commit this page is written against.
Everything on this page is therefore documentation and recorded evidence rather than a product you can run. When that changes, this section changes with it, and the capability register below will move first.
Scanners tell you a port is running nginx. Almost none of them can still show you the response that made them say so, because the moment the process exits, the reasoning is gone.
Cortex writes every probe exchange to a content-addressed store: the exact payload sent, the exact bytes received, the pattern that matched and where it matched, the version of the fingerprint database that supplied it, and a SHA-256 over the response.
A finding then references that hash rather than restating a conclusion. False positives become diagnosable instead of mysterious, results become auditable, and the captured responses become the regression corpus that keeps fingerprinting honest as it grows.
Recorded fixture Illustrative recorded-format fixture for the finished Cortex model, from a purpose-built lab network. Not output from today's engine. Open a row to descend from the claim to the bytes.
The NULL probe sends nothing. It waits to see whether the service speaks first, which is itself evidence.
| 00000000 | 53 53 48 2d 32 2e 30 2d 4f 70 65 6e 53 53 48 5f | S S H - 2 . 0 - O p e n S S H _ |
|---|---|---|
| 00000010 | 39 2e 36 70 31 0d 0a | 9 . 6 p 1 . . |
SSH-2.0-OpenSSH_9.6p1\r\n
| 00000000 | 2a310d0a24340d0a494e464f0d0a | *1..$4..INFO.. |
|---|
*1\r\n$4\r\nINFO\r\n
| 00000000 | 24 31 32 38 34 0d 0a 23 20 53 65 72 76 65 72 0d | $ 1 2 8 4 . . # S e r v e r . |
|---|---|---|
| 00000010 | 0a 72 65 64 69 73 5f 76 65 72 73 69 6f 6e 3a 37 | . r e d i s _ v e r s i o n : 7 |
| 00000020 | 2e 32 2e 35 0d 0a 72 65 64 69 73 5f 67 69 74 5f | . 2 . 5 . . r e d i s _ g i t _ |
| 00000030 | 73 68 61 31 3a 30 30 30 30 30 30 30 30 0d 0a 72 | s h a 1 : 0 0 0 0 0 0 0 0 . . r |
| 00000040 | 65 64 69 73 5f 6d 6f 64 65 3a 73 74 61 6e 64 61 | e d i s _ m o d e : s t a n d a |
| 00000050 | 6c 6f 6e 65 0d 0a 6f 73 3a 4c 69 6e 75 78 20 36 | l o n e . . o s : L i n u x 6 |
| 00000060 | 2e 38 2e 30 2d 34 35 2d 67 65 6e 65 72 69 63 20 | . 8 . 0 - 4 5 - g e n e r i c |
| 00000070 | 78 38 36 5f 36 34 0d 0a 61 72 63 68 5f 62 69 74 | x 8 6 _ 6 4 . . a r c h _ b i t |
| 00000080 | 73 3a 36 34 0d 0a 70 72 6f 63 65 73 73 5f 69 64 | s : 6 4 . . p r o c e s s _ i d |
| 00000090 | 3a 31 0d 0a 74 63 70 5f 70 6f 72 74 3a 36 33 37 | : 1 . . t c p _ p o r t : 6 3 7 |
| 000000a0 | 39 0d 0a 75 70 74 69 6d 65 5f 69 6e 5f 73 65 63 | 9 . . u p t i m e _ i n _ s e c |
| 000000b0 | 6f 6e 64 73 3a 34 31 31 0d 0a | o n d s : 4 1 1 . . |
$1284\r\n# Server\r\nredis_vers7.2.5.2.5\r\nredis_git_sha1:00000000\r\nredis_mode:standalone\r\nos:Linux 6.8.0-45-generic x86_64\r\narch_bits:64\r\nprocess_id:1\r\ntcp_port:6379\r\nuptime_in_seconds:411\r\n
The NULL probe sends nothing. It waits to see whether the service speaks first, which is itself evidence.
| 00000000 | 32 32 30 20 6d 61 69 6c 2e 6c 61 62 2d 61 2e 69 | 2 2 0 m a i l . l a b - a . i |
|---|---|---|
| 00000010 | 6e 74 65 72 6e 61 6c 20 45 53 4d 54 50 20 50 6f | n t e r n a l E S M T P P o |
| 00000020 | 73 74 66 69 78 20 28 44 65 62 69 61 6e 2f 47 4e | s t f i x ( D e b i a n / G N |
| 00000030 | 55 29 0d 0a | U ) . . |
220 mail.lab-a.internal ESMTP Postfix (Debian/GNU)\r\n
The hash shown on each record is the real SHA-256 of the bytes displayed above it. Copy the response out of the page and hash it yourself if you want to check.
This is the whole detection path for the record in the hero, in the order it happens, with what exists in the engine today marked against each step.
Probes are chosen by port and by rarity rather than tried in file order, so a filtered port cannot occupy a worker for minutes.
probe GetRequest PlannedThe probe payload goes out on its own connection. Reusing one socket for every probe is what makes most hand-rolled scanners produce nonsense after the first response.
18 bytes out In developmentThe response is read under a deadline derived from a measured round-trip estimate, capped, and kept verbatim. Binary stays binary.
296 bytes in In developmentPatterns come from a parsed service-probe grammar with dynamic delimiters and escape normalisation. Constructs Go regexps cannot express are recorded as unsupported, not silently counted as parse failures.
offset 25, length 12 In developmentThe version template turns the capture groups into product, version and extra information, with a confidence value and the method that produced it.
nginx 1.27.2, confidence 98 PlannedThe response is stored by content address, de-duplicated across hosts, and the claim keeps a reference to it rather than a copy of it.
sha256:86319f1a…37c7c4 PlannedThe parser that reads the probe grammar is the oldest real code in this project and the reason it exists. Everything marked planned above is designed and unbuilt, and the engine does not compile at its current commit.
Nobody runs a scanner once. Cortex keeps every scan as a structured record, so the question it can answer on the second run is not what is open, but what moved.
Recorded fixture Illustrative recorded-format fixture for the finished Cortex model, from a purpose-built lab network. Not output from today's engine.
Not present in this scan.
Redis key-value store 7.2.5 no authentication required
Not present in the previous scan of this range.
nginx 1.24.0
nginx 1.27.2
Same service, same evidence shape, different version token.
OpenSSH 9.6p1 evidence ev-91ab
OpenSSH 9.6p1 evidence ev-91ac
The version claim did not move. The bytes behind it did: the banner lost its distribution comment.
sha256:1f0c…8ad2 valid to 2026-08-19
sha256:c73b…41e9 valid to 2027-08-20
Replaced one day after the previous certificate expired. Still self-signed.
vsftpd 3.0.5
No longer present. Now answering with a connection refusal.
Now answering with a connection refusal.
Ports, services, certificates and evidence hashes that were byte-identical across both scans. Collapsed by default so that the five rows above are the whole of what a reader has to look at. They are not enumerated in this fixture.
Cortex is a command-line tool that can serve a local viewer over its own scan store, bound to loopback, for the times when a table beats a terminal. This is that viewer, running on the recorded fixture.
Recorded fixture Illustrative recorded-format fixture for the finished Cortex model, from a purpose-built lab network. Not output from today's engine. Nothing here contacts a network. Selection and view switching happen in the page.
| Address | Port | State | Service | Conf. | Method |
|---|---|---|---|---|---|
| 22 | open | OpenSSH 9.6p1 | 96 | probe | |
| 80 | open | nginx 1.27.2 | 98 | probe | |
| 5432 | open | PostgreSQL | 40 | port_default | |
| 22 | filtered | - | - | - | |
| 443 | open | nginx | 62 | tls_alpn | |
| 8443 | open | nginx | 58 | tls_alpn | |
| 25 | open | Postfix smtpd | 88 | probe | |
| 6379 | open | Redis key-value store 7.2.5 | 93 | probe | |
| 21 | closed | - | - | - |
| Address | 21 | 22 | 25 | 80 | 443 | 5432 | 6379 | 8443 |
|---|---|---|---|---|---|---|---|---|
| 10.20.0.7 | 10.20.0.7 port 21: not in this scan | 10.20.0.7 port 25: not in this scan | 10.20.0.7 port 443: not in this scan | 10.20.0.7 port 5432: not in this scan | 10.20.0.7 port 6379: not in this scan | 10.20.0.7 port 8443: not in this scan | ||
| 10.20.0.11 | 10.20.0.11 port 21: not in this scan | 10.20.0.11 port 25: not in this scan | 10.20.0.11 port 80: not in this scan | 10.20.0.11 port 443: not in this scan | 10.20.0.11 port 6379: not in this scan | 10.20.0.11 port 8443: not in this scan | ||
| 10.20.0.14 | 10.20.0.14 port 21: not in this scan | 10.20.0.14 port 22: not in this scan | 10.20.0.14 port 25: not in this scan | 10.20.0.14 port 80: not in this scan | 10.20.0.14 port 5432: not in this scan | 10.20.0.14 port 6379: not in this scan | ||
| 10.20.0.21 | 10.20.0.21 port 21: not in this scan | 10.20.0.21 port 22: not in this scan | 10.20.0.21 port 80: not in this scan | 10.20.0.21 port 443: not in this scan | 10.20.0.21 port 5432: not in this scan | 10.20.0.21 port 6379: not in this scan | 10.20.0.21 port 8443: not in this scan | |
| 10.20.0.33 | 10.20.0.33 port 21: not in this scan | 10.20.0.33 port 22: not in this scan | 10.20.0.33 port 25: not in this scan | 10.20.0.33 port 80: not in this scan | 10.20.0.33 port 443: not in this scan | 10.20.0.33 port 5432: not in this scan | 10.20.0.33 port 8443: not in this scan | |
| 10.20.0.42 | 10.20.0.42 port 22: not in this scan | 10.20.0.42 port 25: not in this scan | 10.20.0.42 port 80: not in this scan | 10.20.0.42 port 443: not in this scan | 10.20.0.42 port 5432: not in this scan | 10.20.0.42 port 6379: not in this scan | 10.20.0.42 port 8443: not in this scan |
Excluded from this design on purpose: summary tiles, a chart wall, and anything resembling threat intelligence. A scan is not a business metric, and a viewer for one should stay an instrument.
Seven stages in a line, and four concerns that cut across all of them. The four are the reason the seven can be trusted, and they are where most hand-rolled scanners quietly have nothing.
One process. No broker, no queue service, no database server, no container required. The finished tool is a single binary that holds the engine, the fingerprint database, the store and the viewer.
Aggressive defaults are easy to build and hard to live with. These are the constraints the finished tool is designed around, and most of them cost throughput on purpose.
Connect scanning, TLS observation and HTTP observation need no elevation on any platform. That path is what most people should ever use, and it is the default.
Raw sockets are opt-in. Asking for a SYN scan without the capability fails with the exact command needed to grant it, rather than quietly falling back to a different scan that produces different results.
Raw handles are acquired at startup, then the process drops to the invoking user. Parsing whatever a target chooses to send back happens unprivileged, because that parser is the largest attack surface in a scanner.
A token bucket, a concurrency ceiling and a per-host cap, with conservative defaults and adaptive backoff when a target starts rate-limiting. A scanner that cannot be slowed down is a liability on someone else network.
Past a threshold, a scan prints the computed host count, probe count and estimated duration and waits. Accidentally scanning a /8 should take more than one typo.
No route, permission denied and file descriptor exhaustion are scan errors with their own class. Reporting them as filtered is silent data corruption, and it is the single most common defect in this category.
Captured responses will contain credentials sooner or later. The store is written owner-only, known credential patterns are redacted before persistence with the redaction recorded, and reports can be exported redacted.
Probes send the bytes a legitimate client would send. No exploitation, no brute forcing, no fuzzing, no denial of service, no evasion features. This boundary is not a phase, it is the product definition.
Nmap is the reference implementation of this entire category and it wins most of these rows. Cortex is not trying to replace it. It is trying to answer a different question about the same network.
Around 2,600 curated fingerprints built on sixteen carefully sequenced probes, with two decades of community submissions behind them.
None. Not in the plan either: one person cannot build that corpus, and pretending otherwise would waste the years it would take.
NSE, roughly six hundred scripts and the community that maintains them.
No scripting. If it ever arrives it will be sandboxed and narrow, and it will not be a plugin ecosystem.
Correct link-layer framing, ARP, routing, fragmentation and IPv6, hardened across a dozen operating systems.
The current raw path is structurally wrong and is being rewritten. The unprivileged path comes first because it is what most scans need.
Twenty-five years of platform work. It runs where you need it and it has been wrong in public often enough to be right now.
Three platforms are targeted. Zero releases exist. Nothing here has been field tested by anyone.
Adaptive timing, retransmission and congestion control. For pure throughput, masscan and its relatives are faster still.
Not competing. No throughput number has been measured, so none is published, and that race is already won by other tools.
ndiff compares two saved XML files and reports host and port differences.
Diff is a verb over a persistent store, so it can also compare evidence hashes, certificate rotation and version movement, not only presence.
XML designed in 1997, which every consumer wraps in a parser library. There is still no JSON output upstream.
JSON and JSONL from the first line, schema-versioned and deterministically ordered so two runs can be compared byte for byte.
Debug output is unstructured text on a terminal, and it is gone when the process exits.
Every probe exchange is stored by content address and referenced by the claim it supports. This is the reason the project exists.
Installed from a package, with a data directory alongside it, and available on essentially every platform you might already be standing in front of.
Targets one signed executable with the fingerprint database compiled in, so a fresh machine needs nothing else. Nothing is published yet.
Four rows to nmap, three to Cortex, two that are not the same question. A comparison table where one column wins everything is an advertisement, not information.
Nothing on this page is a released capability. At commit eabc16d the
engine does not compile, there are no tests, and no binary has ever been published.
This site describes the tool Cortex is designed to be. It exists ahead of the engine on purpose, as the specification the engine is being built against. Every screen you have scrolled past is driven by an authored fixture in the finished data format, and every one of them says so on the object itself.
Cortex is developed privately, so nobody can check these claims against the source. That is exactly why the register below is written the way it would have to be written if they could: every row states what is actually there, including the parts that are wrong or missing.
| Capability | Status | What exists today |
|---|---|---|
| TCP connect scanning, three-state classification | In development | Implemented, including the pre-read that separates a reset from a timeout. Not release quality. |
| Service-probe grammar parser | In development | The oldest real code here. Dynamic delimiters, escape normalisation, and constructs Go regexps cannot express recorded as unsupported rather than as failures. Soft matches and fallback chains are not handled. |
| Probe selection by port and rarity | Planned | The rarity, ports and sslports directives are parsed and discarded, so every probe is tried in file order. |
| Probe exchange and banner capture | In development | Probes run, but all of them share one connection and the first response of any kind wins. A name is extracted; product, version, extra information and CPE are not. |
| Plain text and JSON output | In development | Both exist. Ordering is not deterministic yet, which is a prerequisite for diff. |
| SYN scanning | In development | Present and structurally wrong: a capture handle per port, no link-layer framing, no retransmission. Scheduled for rewrite, and it may be deferred past the first release. |
| UDP scanning | In development | Sends a single null byte. The parsed UDP probe corpus is loaded and never used. |
| Product and version extraction | Planned | Designed. The version template parser is an open task in the engine. |
| TLS and HTTP observation | Planned | Designed. Nothing imports a TLS library today. |
| Content-addressed evidence store | Planned | Designed. This is the centre of the product and none of it is built. |
| Scan store, list and show | Planned | Designed against SQLite. Today results are held in memory or in a Redis instance that is being removed. |
| Diff between scans | Planned | Designed. Depends on the store and on deterministic ordering. |
| Rate limiting, concurrency ceilings, cancellation | Planned | Designed. The current engine has none of the three, which is its most dangerous property. |
| Host discovery | Planned | Designed. Every listed host is currently assumed to be up. |
| Command interface: scan, list, show, diff, report, ui | Planned | Designed as verbs. Today the binary takes positional arguments and switches to server mode on a raw string match. |
| Local viewer, cortex ui | Planned | Designed, and previewed on this page from a fixture. The interface built so far is a mock that never contacts an engine. |
| Single binary with embedded fingerprints | Planned | Designed. The binary currently refuses to start without an external data file that is not shipped. |
| Released, signed binaries | Planned | None exist. No installation path is published anywhere. |
| Reference documentation and changelog | Planned | Neither exists. This page is the only current documentation, and it is written by hand. |
| Automated tests | Planned | There are none. Zero, of any kind. |
No performance figure appears anywhere on this site, because no measurement of any kind exists yet. When a benchmark harness is published, the numbers will arrive with the hardware, the settings and the commit that produced them, and with the cases where nmap is faster.
Cortex is developed privately, so this page is its documentation rather than a summary pointing elsewhere. Each entry below is a section of it, written to be read by someone deciding whether the engineering is sound.
Planned A versioned reference and a changelog, once there is a release to describe. Until then this page is kept current with the engine rather than left to drift.