Recon AI 🔐

Network security that actually makes sense — for everyone, not just the people who already know what a CVE is.

Recon AI scans your network, finds vulnerabilities, reads your system logs, and explains what it found in plain English. No jargon. No degree required. No API key required.

Most security tools assume you already know what you're doing. They're powerful — and completely useless if you don't already speak the language.

Meanwhile, the people who actually need security help the most — small businesses, schools, clinics, solo IT admins — have nothing built for them.

Recon AI is my attempt to fix that. Scan your network, get a score, understand what's wrong, know exactly what to do about it.

You don't need an API key to use Recon AI.

There's a built-in knowledge base that explains every finding it surfaces — what the open port is, why it matters, who could exploit it, and exactly how to fix it. Step by step. No data sent anywhere. No account needed. Nothing.

The AI analysis (powered by Claude) is there when you want a deeper, more personalized breakdown. But the assistant that walks you through your results? That's built in and it's free.

Open Recon AI in your browser
         ↓
Pick your tools — port scanner, network mapper, log analyzer, vuln reporter
         ↓
Enter your IP and run the scan
         ↓
Get a health score from 0–100
         ↓
Every finding explained in plain English with step-by-step fix instructions
         ↓
Optional: send findings to Claude AI for a deeper breakdown
         ↓
Download the full report as a .txt file
         ↓
Explore Network Intelligence — understand your interfaces, ARP table, active connections, and routes in plain English

You could paste a security report into ChatGPT or Claude and ask it to explain things. That works. But they can't ping your subnet. They can't open a socket and check what's actually running on your router right now. They can't read your local system logs. They can't tell you if someone installed an AI tool on a device you didn't authorize.

Recon AI runs locally on your machine — which means it has access to things no external tool ever could. The AI analysis is just the explanation layer on top of real local data that only you can collect.

• 🌐 Runs in your browser — Flask web interface, no command line needed after setup
• 📖 Built-in assistant, no API key needed — explains every finding offline, zero data sent anywhere
• 🧠 Optional AI analysis — Claude gives a deeper, more personalized breakdown when you want it
• 🔒 Three AI modes — Standard (Claude API), Private (local Ollama, zero data leaves your machine), Offline (built-in knowledge base, always free)
• 🤖 Multi-agent adversarial review — findings are challenged by an Adversary Agent before you see them. A Risk Prioritizer tells you the one most important action to take.
• 📊 Network Health Score — 0–100 score so you know at a glance how your network looks
• 🛡️ Prompt injection protection — four-layer sanitizer prevents adversarial inputs in device names or log files from manipulating the AI
• 🏛️ NIST & OWASP compliance mapping — every finding mapped automatically, explained in plain English
• 🔍 Zero Trust verification — detects implicit device trust and unknown devices by MAC address
• 🚨 Port change alerting — alerts when a known device opens a new port since your last scan
• 🔥 Firewall status check — tells you if your local firewall is on or off in plain English
• 🔐 ARP poisoning detection — flags when a device's MAC address changes between scans
• 📜 SSL certificate checker — checks HTTPS services for expired or expiring certificates
• 📄 Downloadable reports — every scan saved as a .txt file
• 🛡️ Security hardened — SSRF protection, rate limiting, HTTP security headers, SQLite WAL mode
• 🖥️ macOS, Windows, Linux — cross-platform

No Python, no setup, no terminal. Just download and double-click.

Windows: Windows Defender may show a "Windows protected your PC" warning. Click "More info" → "Run anyway." This is expected for unsigned applications.

macOS: If macOS blocks the app, go to System Settings → Privacy & Security → click "Open Anyway."

You need Python 3.11+. An Anthropic API key is optional — only needed for AI analysis.

# Clone
git clone https://github.com/PRXSM/recon-ai.git
cd recon-ai

# Virtual environment
python3 -m venv venv
source venv/bin/activate        # macOS/Linux
venv\Scripts\activate           # Windows

# Dependencies
pip install -r requirements.txt

# API key — only needed for AI analysis
cp .env.example .env
# Open .env and add your Anthropic API key

# Run
python3 app.py
# → http://localhost:5000

recon-ai/
├── app.py                     # Flask routes, validation, security hardening
├── engine.py                  # Risk scoring, scan summary, report builder
├── port_scanner.py            # TCP port scanner (simple 1–1024, deep 65,535)
├── network_mapper.py          # Ping-based host discovery, MAC vendor lookup
├── log_analyzer.py            # 30+ threat pattern detection
├── vulnerability_reporter.py  # Port → vulnerability database
├── ai_assistant.py            # Claude API integration, three AI modes
├── ai_agents.py               # Adversary Agent + Risk Prioritizer
├── plain_english.py           # Offline knowledge base
├── network_intel.py           # Network Intelligence engine
├── system_inspector.py        # Suspicious process and startup item scanner
├── credential_scanner.py      # Credential risk assessment
├── shadow_ai.py               # Shadow AI discovery + SSL cert checker
├── nist_owasp.py              # NIST & OWASP compliance mapping
├── zero_trust.py              # Zero Trust verification
├── prompt_injection.py        # Four-layer prompt injection sanitizer
├── firewall_check.py          # Local firewall status check
├── scan_memory.py             # Scan history, port change alerting, ARP poisoning detection
├── device_fingerprint.py      # MAC vendor lookup via IEEE OUI database
├── templates/
│   ├── index.html             # Scan form
│   ├── results.html           # Results display
│   ├── shadow_ai.html         # Shadow AI findings display
│   ├── network_intel.html     # Network Intelligence dashboard
│   ├── arp_table.html         # ARP table explained
│   ├── netstat.html           # Active connections explained
│   └── traceroute.html        # Route tracing explained
├── oui.csv                    # IEEE OUI database for MAC vendor lookup
├── .env.example               # API key template
├── requirements.txt
└── README.md

Every scan produces a health score from 0–100. It's not perfect — no single number ever is — but it gives you a starting point.

Deductions: -2 per open port, up to -20 per critical vulnerability, up to -10 per log finding.

• Your IP is never sent anywhere — redacted before any AI call is made
• AI analysis is opt-in — there's a checkbox, it's off by default
• Private Mode sends nothing at all — local Ollama inference only
• Offline Mode requires zero API calls and zero data sharing
• Everything runs locally — no accounts, no server, no data collection
• Your API key lives in .env and never gets uploaded

Scan networks you own or have explicit permission to scan. Unauthorized scanning is illegal under the CFAA and equivalent laws worldwide. Recon AI asks for authorization confirmation before every scan. This is a defensive tool — built to help you understand your own network.

There's a school IT admin somewhere managing 200 devices alone, no security budget, no security training, no time. Every Monday morning they just need to know: is everything okay?

Green, yellow, or red. That's it.

That's who every decision in this project is built around.

Asama Azim — IT & Cybersecurity | CompTIA Network+ Certified | Security+ in progress

GitHub | LinkedIn