Checking for exposure

apn scan

apn scan checks the agent runtimes on this host for the two ways they get taken over:

• a listener bound to every network interface — an agent’s API reachable from outside the machine
• credential files other users can read — the keys the agent works with, sitting where anyone on the box can take them

It needs no hub, no account and no network. It works on a machine that has never heard of AgentPod, which is the point.

Running it without installing AgentPod

The installer in Your first node enrolls the machine, so it wants a hub and a token. apn scan wants neither — download the released binary on its own and run it where it lands:

curl -fsSLO https://github.com/SuperJackfruitLabs/agentpod/releases/latest/download/agentpod-node-linux-amd64
curl -fsSLO https://github.com/SuperJackfruitLabs/agentpod/releases/latest/download/SHA256SUMS
sha256sum --ignore-missing -c SHA256SUMS    # macOS: shasum -a 256 --ignore-missing -c SHA256SUMS
chmod +x agentpod-node-linux-amd64
./agentpod-node-linux-amd64 scan

Each release publishes agentpod-node-linux-amd64, agentpod-node-linux-arm64, agentpod-node-darwin-amd64 and agentpod-node-darwin-arm64. apn is only the installer’s name for this binary; downloaded directly, it keeps the release name. Nothing is written to the machine besides the file you downloaded.

Exit codes

Code	Means
0	Clean
1	Warnings
2	Critical

That makes it usable directly in cron or CI.

apn scan --json        # machine-readable
apn scan --no-color    # plain output for logs

It does not guess

A check that cannot determine an answer reports unknown, and says why. It is never reported as a pass.

This is a deliberate design rule, and it costs something: you will sometimes see “unknown” where a more confident tool would show a green tick. That is the trade being made. A scanner that cries wolf gets ignored, and a scanner that quietly calls an unknown a pass is worse than one that says nothing.

There is also no CVE feed. A version-to-CVE database rots the moment it ships, and it would turn a static binary into something that has to phone home to stay honest. Every check here is a property of the machine as it is right now.

In the console

The same checks surface as a posture banner on nodes and stations, so an exposure found on a host you have not logged into lately is still in front of you.

Next

• apn and fleet — the rest of the surface