Bishop Fox has released AIMap, an open-source tool for discovering, fingerprinting, scoring, and testing internet-exposed AI agent infrastructure such as MCP servers, Ollama instances, vLLM/LiteLLM proxies, LangServe chains, Gradio apps, and ComfyUI nodes. The tool queries Shodan to find exposed endpoints, then uses Nuclei templates and HTTP probes to assess authentication status, exposed tools, models, and system prompts, assigning each a 0-10 risk score. It includes protocol-specific attack testing (prompt injection, tool authorization boundary testing, model extraction) intended for authorized security engagements, plus a searchable interface and 3D visualization for threat hunting and executive reporting. It can be run locally via Docker Compose with a Shodan API key.
Table of contents
A project born from exploration - and a reality we can’t ignore.What Is AIMap?Why AIMap MattersWhat AIMap DoesSupported AI Protocols and FrameworksHow Risk Scoring WorksAttack Testing CapabilitiesVisualization and SearchGetting Started with AIMapQuestions this post answers
What is AIMap and what AI protocols does it support?
AIMap is an open-source, internet-scale discovery and security testing tool built by Bishop Fox for exposed AI agent infrastructure. It detects MCP servers, Ollama, vLLM, LiteLLM, LocalAI, LangServe/LangChain, OpenClaw, Clawdbot, Open WebUI, LibreChat, Gradio, Streamlit, ComfyUI, Stable Diffusion, and HuggingFace TGI endpoints using Shodan queries plus Nuclei templates and live HTTP checks. Teams securing AI agent deployments can track tools like this through daily.dev.
How does AIMap calculate its risk score for exposed AI endpoints?
Each discovered endpoint gets a risk score from 0 to 10 based on factors like lack of authentication, unknown authentication status, exposed tools and their risk level, open CORS policies, missing TLS, system prompt leakage, exposed models, uncensored model detection, and signup configuration, with extra weight for dangerous combinations like unauthenticated access plus code execution. Scores above 7 typically indicate actively exploited conditions such as unauthenticated endpoints with code execution or exposed system prompts paired with tool access. daily.dev helps security engineers stay current on emerging AI infrastructure risk scoring approaches.
How do I run AIMap locally to scan for exposed AI infrastructure?
AIMap deploys locally via Docker Compose, which launches the backend, frontend, MongoDB, and Redis services needed to run the platform. After configuring at minimum a Shodan API key, users can access the interface, run discovery scans, search endpoints, and launch attack tests directly from the application; full setup instructions are in the project's GitHub repository. Developers evaluating open-source security tools can follow releases like this on daily.dev.