Shadowlight

  ╔═╗╦ ╦╔═╗╔╦╗╔═╗╦ ╦╦  ╦╔═╗╦ ╦╔╦╗
  ╚═╗╠═╣╠═╣ ║║║ ║║║║║  ║║ ╦╠═╣ ║ 
  ╚═╝╩ ╩╩ ╩═╩╝╚═╝╚╩╝╩═╝╩╚═╝╩ ╩ ╩ 
  ───────────────────────────────
  shadow AI exposure scanner  ·  v1.0.0  ·  authorized use only
  by Arman Manteghi  ·  github.com/Arman-Manteghi

A command-line scanner that finds AI infrastructure on your network that anyone can use without a password.

Ollama, vector databases, model servers, AI web interfaces and MLOps tools are usually installed for a quick test and ship without authentication. Once one of them is reachable from outside the machine, it exposes your models, your embeddings and your GPUs. Shadowlight scans the addresses you give it, recognises 23 services, checks read-only whether each one answers without credentials, and tells you what to fix.

• Pure terminal tool: one pip install, one command, no dependencies.
• Read-only: it never writes, deletes or modifies anything on a target.
• Public internet addresses are refused unless you confirm you are authorised.
• Recognises services by what they answer, not only by their port, so it also finds them on non-default ports.
• Matches the detected version against known vulnerabilities and raises the risk when it is outdated.

Install

Requires Python 3.10 or newer (this release is built for Python 3.10, 3.11, 3.12, 3.13, 3.14).

pip install shadowlight

Then run shadowlight. Upgrade with pip install --upgrade shadowlight, remove it with pip uninstall shadowlight.

To keep it isolated from your other packages, and have the command on your PATH automatically, use pipx instead: pipx install shadowlight. If the command is not found after a plain pip install, run python -m shadowlight.

The same build is also attached to every release here, if you prefer to install straight from GitHub:

pip install https://github.com/Arman-Manteghi/shadowlight/releases/download/v1.0.0/shadowlight-1.0.0-py3-none-any.whl

or download shadowlight-1.0.0-py3-none-any.whl from the Releases page and run pip install shadowlight-1.0.0-py3-none-any.whl.

If you see has no build for Python x.y, your Python is newer or older than the versions this release was built for.

Use

Run it with no arguments and it asks what to scan:

shadowlight

Or give it targets directly:

shadowlight 192.168.1.0/24
shadowlight 10.0.0.5-40 -p ollama,qdrant
shadowlight 10.0.0.0/24 -p llm,vector -o report.html
shadowlight --list

What it detects

Any other server that speaks the OpenAI API is caught by a generic signature.

In CI and scheduled scans

Exit status is 0 when the rule passes and 2 when it trips, so it can gate a pipeline:

shadowlight 10.0.0.0/24 --json -o today.json --baseline last.json --fail-on new

Responsible use

Only scan systems you own or have written permission to test. Shadowlight only sends read-only requests, but scanning other people's systems can still be illegal. Public addresses are refused unless you pass --authorized.

Verify your download

SHA256SUMS.txt lists the checksum of the wheel. In PowerShell:

Get-FileHash .\shadowlight-1.0.0-py3-none-any.whl -Algorithm SHA256

On Linux or macOS use sha256sum shadowlight-1.0.0-py3-none-any.whl.

Author

Shadowlight is built and maintained by Arman Manteghi.

License

Free to use for authorised security testing, personal or internal business use. Redistribution, modification, reverse engineering and use against systems you are not authorised to test are not permitted. Read LICENSE.txt before using it.

Copyright (c) 2026 Arman Manteghi. All rights reserved.