nmaptui is an admin console for nmap that runs in the terminal. It is open source (MIT), it is on npm as @profullstack/nmaptui, and it installs with one line:
curl -fsSL https://raw.githubusercontent.com/profullstack/nmaptui/main/install.sh | sh
nmap itself is fine. What it lacks is a place to live between scans. You run it, read the output, lose the output, run it again a month later, and wonder what changed. nmaptui keeps every scan, shows it in eight screens, and diffs any two.
What is in it
A scan builder with eighteen profiles (Quick, Intense, Ping sweep, Vulnerability scripts, Web services, Windows and SMB, Databases, Top 100 UDP, and so on) and a form for every nmap option that matters, each with a one-line explanation. The exact command nmap will get sits underneath the form, with a count of how many addresses the targets cover and a warning when the scan needs root.
A live view. nmaptui runs nmap with XML on stdout and reads it as it streams, so tasks appear as they start, nmap's own percent and time remaining show once it reports them, and each host lands in the table the moment nmap finishes it. Abort keeps what came back.
Hosts, Services and Findings. The hosts screen is the usual per-host detail: ports, versions, OS matches, uptime, traceroute, script output. The services screen pivots the scan the other way, so "which boxes still run OpenSSH 7" is one row. Findings is a triage list from rules over the scan: clear-text protocols, anonymous FTP, SMBv1 and unsigned SMB, databases and RDP reachable from the network, expired certificates, weak TLS, end-of-life operating systems, and anything an NSE script marked VULNERABLE.
History and diff. Scans are kept as nmap's own XML under ~/.local/share/nmaptui. Mark two and you get hosts that appeared or vanished, ports that opened or closed, and services whose version moved. Any file made with nmap -oX can be imported.
Export to text, JSON, CSV, Markdown, HTML or the raw XML. nmaptui print and nmaptui diff work without a terminal, so a nightly diff in a cron mail is a few lines of shell.
How it is built
It is TypeScript on HQTUI, with no other runtime dependency. The XML reader is 290 lines and has a streaming mode that hands over each complete host element as the bytes arrive. Screens are pure functions of one state object, and the tests render real frames headlessly and assert on the text, so a layout regression fails a test instead of waiting for someone to notice. 53 tests run under both node --test and bun test.
The screenshots in the README are a real connect scan of profullstack.com, captured through a pty. It sits behind Pingora with two ports open and 998 filtered, which is about the right answer.
Top comments (0)