navig-devnet

Developer/ops network inspection: DNS/WHOIS/SSL lookups and an SSRF-guarded HTTP repeater — its own navig-devnet command, and navig devnet inside navig.

Works on its own — its own CLI, no navig required · v0.5.0 · not on PyPI yet (install from source below)

On its own (no navig needed)

pip install "git+https://github.com/navig-run/plugins#subdirectory=navig-devnet"
navig-devnet --help   # no navig needed

With navig

pip install "git+https://github.com/navig-run/plugins#subdirectory=navig-devnet"
navig devnet --help

Developer/ops network inspection for NAVIG — the first slice of the DevNet Lab. Runs standalone (navig-devnet) or inside navig (navig devnet), and the agent can call the same lookups.

What's here

Lookups (read-only):

The lookups resolve names and read a server's own certificate — nothing sends a payload or mutates a target.

HTTP repeater:

The repeater is SSRF-guarded (shared with navig via navig-sdk): the initial URL and every redirect hop are re-validated, so a 302 to a private/metadata address is blocked, not followed. Private/internal targets need --allow-private (or net.ssrf.allow_private_network). The net_http agent tool is classified dangerous — the agent asks before sending on your behalf. Add --json to any command for machine-readable output.

Crawl & API discovery (read-only):

Both are read-only (GET-only) and SSRF-guarded like the repeater — private/ internal targets need --allow-private. The crawl honours robots.txt by default, stays on the start URL's origin, and caps pages/depth so it maps a service rather than hammering it. net_crawl/net_api_discover are safe agent tools (no payload, no mutation).

Per-space activation

devnet is a toggleable module. A workspace scopes it through its space.json:

{ "modules_disabled": ["devnet"] }   // off in this space: no CLI verb, no agent tools
{ "modules_enabled":  ["devnet"] }   // force on in this space

The toggle governs the devnet CLI verb, the devnet agent toolset, and (later) the DevNet Lab tile together — not just a sidebar view.

Roadmap

HTTP repeater, browser traffic inspection (headers/bodies + a DevNet Lab OS tile), crawl/API-discovery, and — owner-approved and authorization-gated — active scanning and an intercepting proxy (DANGEROUS + owner-only, per the engagement authorization record). See the project plan.

Install

pip install navig-devnet          # standalone
# or, with navig:
pip install "navig[devnet]"