BishopFox/aimap

What it is

AIMap (BishopFox/aimap) is a self-hosted platform you deploy yourself — not a service. It combines a React/Vite SPA, a Python/FastAPI backend with async MongoDB (Motor) and Redis Streams, and a discovery engine that chains Shodan → httpx liveness → Nuclei → an enrichment/scoring pipeline. Scanning ships with 5 custom Nuclei YAML templates (MCP server detection, MCP tool enumeration, OpenAI-compatible API detection, LangServe detection, prompt-leak testing).

Preconditions / operational requirements

• Python 3.12+, Node 18+, MongoDB 7+, Redis 7+ (optional; falls back to in-memory), Nuclei (optional; required for active scanning).
• A Shodan API key is required for any discovery scan. Censys (CENSYS_API_ID/SECRET) and ANTHROPIC_API_KEY (for "AI-powered attack analysis") are optional.
• Explicit legal warning: authorized pen-testing only, against systems you own or have written permission to test.

What to do

Docker path brings up four services (MongoDB 27017, Redis 6379, backend 8000, frontend 80):

git clone git@github.com:BishopFox/aimap.git
cd aimap
cp .env.example .env
# Edit .env — at minimum set SHODAN_API_KEY
docker compose up --build

Then open http://localhost.

Security-relevant defaults to change before exposing this anywhere:

• CORS_ORIGINS=* by default — allows all origins.
• Auth is off unless configured. AIMap uses Clerk; leaving CLERK_ISSUER empty makes the backend "accept all requests with a synthetic local user identity." To enable auth, set CLERK_ISSUER=https://your-app.clerk.accounts.dev and, in frontend/.env.local, VITE_CLERK_PUBLISHABLE_KEY=pk_test_....
• MODAL_ENABLED=false by default; setting it dispatches scans/attacks to Modal serverless containers.

Risk-score thresholds the search language exposes (useful for triage queries):

risk:critical   # >= 9.0
risk:high       # 7.0 – 8.9
risk:medium     # 4.0 – 6.9
risk:low        # 1.0 – 3.9

Filters combine, e.g. protocol:mcp auth:none country:US or risk:critical tool:exec_code. Scans can be scoped to a CIDR — the orchestrator prepends net:<cidr> to each Shodan query.

Caveats

The page describes only 5 Nuclei templates and "32+ curated" Shodan queries; coverage is whatever those enumerate. Active scanning and discovery are both gated on external dependencies (Nuclei binary, Shodan key) — without them the tool is inert. No version, release date, or CVE is given.