Agentic Local-Network Scanner (Claude Code)
Overview
A small build in driving local-network discovery through a Claude Code agent, using a tightly scoped allow-list of standard networking commands (ARP table reads, ping sweeps, port checks, traceroute).
Why It Exists
To explore whether an agent can perform safe, bounded LAN reconnaissance, enumerate hosts, test reachability, and probe ports, when constrained to a small set of explicitly permitted shell commands.
What We Built
As checked in, the project is essentially a Claude Code permission configuration (.claude/settings.local.json) that allow-lists a curated set of read-only/diagnostic networking commands: arp -a -n, filtered awk/sort over the ARP table, targeted ping, nc -z port checks, and short traceroute runs against specific hosts. The agent uses these to map and probe the local subnet. There is no custom application code beyond the scoped permission set.
Technologies & Approach
Standard POSIX networking utilities invoked under a Claude Code agent, with safety enforced through an explicit command allow-list rather than free-form shell access. Documented honestly as a lightweight build.
Outcome / Impact
Demonstrates an approach to safe agent-driven network reconnaissance, constraining a capable agent to a vetted command surface. An early-stage build.
Capabilities Demonstrated
- Designing scoped, allow-listed command surfaces for agents
- Local-network discovery with standard diagnostic tooling
- Applying guardrails to agentic security/recon workflows