Corvus
A network scanner that remembers.
nmap, masscan and rustscan answer one question, what is open right now, then throw the state away. In security the signal that matters is the change: what appeared, what vanished, when, and why.
A stateful network intelligence engine. Corvus versions every host, port and service observation as a time series, diffs each scan against history, fuses passive intelligence before scanning, surfaces anomalies, correlates CVEs, and answers questions in plain English. Solo-built full-stack: 10.7k lines of Go across 24 packages plus a 7.6k-line Next.js dashboard.
One Go binary exposes a CLI, a Bubble Tea TUI, and a Fiber REST API with WebSocket streaming. Observations persist in an embedded bbolt store. Nodes coordinate over an encrypted UDP gossip mesh. The Next.js 16 frontend renders scans, host history, the mesh, and the natural-language ask view.
Temporal records are keyed by big-endian timestamps, so the store's natural key order is chronological and history range-scans become a single cursor seek. The diff engine is a set reconciliation of ports seen this scan against ports the store believes open, which is how closed ports get detected. Token-bucket rate limiting governs scan rate, and worker pools fan out the scanning.
Go gives a single static binary, goroutine-driven concurrency for scanning thousands of endpoints at once, and a first-class network stack. Next.js carries the streaming dashboard.
Change is a first-class event, not a diff you compute by hand. Predictive intelligence scores a target from DNS, ASN and certificate-transparency data before a single packet is sent, so scanning starts smart instead of brute-forcing 65,535 ports.
Continuous attack-surface monitoring and cloud-drift detection as a product. The temporal core is a moat competitors structurally lack.