AIMap - AI Infrastructure Exposure Scanner Cheatsheet
AIMap is an open-source platform for finding exposed AI infrastructure on the internet. As teams rushed to self-host LLMs, a large number of Ollama servers, MCP endpoints, and inference proxies ended up reachable from the public internet with no authentication. AIMap discovers these at scale, fingerprints what is running, scores the exposure, and can run protocol-specific attack tests against targets you are authorized to assess. Think of it as nmap for the AI serving layer.
Authorized targets only. Discovery at internet scale and active protocol testing have legal implications. Scan only assets you own or are explicitly permitted to test.
Installation
| Method | Command |
|---|
| pip | pip install aimap |
| Docker | docker run -it aimap/aimap |
| From source | git clone the repo, then pip install -e . |
| Verify | aimap --version |
Core Usage
| Command | Description |
|---|
aimap scan 10.0.0.0/24 | Scan a CIDR you own for AI services |
aimap scan --target host:11434 | Check a specific endpoint |
aimap fingerprint <target> | Identify the service and version |
aimap score <target> | Produce an exposure score |
aimap --help | Full option list |
What It Discovers
| Service | Default port | Risk when exposed |
|---|
| Ollama | 11434 | Model listing, prompt abuse, resource theft |
| MCP endpoints | varies | Tool invocation, data access |
| Inference proxies | 8000/8080 | Unmetered model access |
| vLLM / OpenAI-compatible | 8000 | Free inference, prompt exfiltration |
| Vector databases | 6333/8080 | Embedded document leakage |
Exposure Scoring
| Factor | Raises score |
|---|
| No authentication | Anyone can call the API |
| Model listing enabled | Reveals internal model inventory |
| Tool access (MCP) | Endpoint can take actions |
| Verbose errors | Leaks configuration/paths |
| Writable endpoints | Model upload/deletion possible |
Protocol Tests
| Test | Checks |
|---|
| Unauthenticated access | Does the API answer without a key? |
| Model enumeration | Can models be listed? |
| Prompt injection surface | Are system prompts reachable? |
| Resource abuse | Can an attacker run inference for free? |
| MCP tool inventory | What tools can be invoked? |
Common Workflows
# Audit your own infrastructure for accidentally-exposed AI services
aimap scan 10.0.0.0/16 --output exposure.json
# Verify a specific self-hosted Ollama is not publicly reachable
aimap fingerprint ollama.internal.example.com:11434
# Score and report for a compliance review
aimap score --target api.internal.example.com --format json
Defensive Checklist
| Control | Why |
|---|
| Bind to localhost | OLLAMA_HOST=127.0.0.1 rather than 0.0.0.0 |
| Auth proxy | Put an authenticating reverse proxy in front |
| Network policy | Firewall/VPC rules; never expose 11434 publicly |
| Rate limits | Blunt resource-abuse attacks |
| Monitor | Alert on unexpected inference traffic |
The most common real-world finding is simply an Ollama server bound to 0.0.0.0 on a host with a public IP.
AIMap vs General Scanners
| Aspect | AIMap | nmap | Shodan |
|---|
| Focus | AI/LLM serving layer | Generic ports/services | Internet-wide index |
| Fingerprinting | AI-protocol aware | Generic service probes | Banner-based |
| Attack tests | AI-specific | Scripts (NSE) | None |
| Best for | AI infra exposure audits | General recon | Passive discovery |
Resources
