Skopia

By Seraf Inc. · Free · Android and Linux · runs entirely on your device

Skopia.

Scans the WiFi you are on, hears the Bluetooth around you, and checks the websites and domains you own — then tells you what is wrong in plain English, with the fix. Everything runs on your device. Nothing is uploaded, there is no account, and there is no server to leak.

Skopia (σκοπιά) is Greek for the lookout — the high place you watch from, so you see trouble before it reaches the door.

Free. Every scan and every check, unlimited, permanently. An optional Pro unlock adds AI analysis on your own API key.

Checks
Seventeen, across four surfaces
Speed
About twelve seconds, start to answer
Uploads
Nothing. There is no backend

Four things most people never check.

Each one is a place trouble hides. Nothing else puts all four in one app — Jetpack does sites and bills monthly, Fing does networks and sells a dongle, and neither hears a tracker tag or looks at the phone in your hand.

Your WiFi

Who else is on this network

  • Every device on your local network, named where it can be
  • Risky services flagged with the fix: Telnet, FTP, ADB, SMB, RDP, VNC, Redis, MongoDB, UPnP
  • Deep scan of one device across 44 ports
  • Router serving its admin page over plain HTTP
  • An alert when a device you have never seen before joins

The radio around you

What is broadcasting nearby

  • Twelve seconds of listening to Bluetooth advertisements
  • Phones, earbuds, watches, speakers, TVs, beacons, tags
  • Tracker-tag detection — AirTag, SmartTag, Tile and similar
  • Manufacturer named from the Bluetooth SIG company ID
  • Listens only. Never connects, never pairs

Your sites

Whether the web thinks you are safe

  • Certificate, and how many days are left on it
  • The full redirect chain, including the plain-HTTP first hop
  • Six security headers, scored, with the exact header to add
  • Whether it answers at all, and how fast

Your domains

Whether you could lose the name

  • Expiry, from the registry's own record — not your calendar
  • Transfer lock: whether clientTransferProhibited is actually set
  • SPF and DMARC — and whether p=none is quietly letting anyone send as you
  • DNSSEC and CAA
  • For names you want: exactly where they sit in the drop cycle

And a fifth surface most tools ignore entirely: this phone — user-installed certificate authorities, developer options and wireless debugging left on, private DNS, VPN state, and how stale the security patch is.


The app.

Real screens. The network in them is a fixed example, not yours.


Where your data goes.

Nowhere. That is not a promise about our policy, it is a fact about the architecture — there is no server for it to go to.

No account

Nothing to sign up for

Install it and it works. There is no email, no password, no profile, and no identifier of any kind. We have no way to tell whether you have ever opened the app.

No backend

The scanning happens here

The sweep, the Bluetooth listening, the certificate checks, the header grading — all of it runs on your device. Results are written to the app's own private storage and never uploaded.

No analytics

Not even the usual ones

No crash reporting, no telemetry, no advertising ID, no third-party SDKs. The only outbound requests are to your own network, to sites you added yourself, and to public DNS and registry services.


AI analysis, if you want it.

The free app finds things. Pro adds an agent that reasons about what it found — and shows every step it took, so you can check the answer instead of trusting it.

How it works

Your key, your bill

You add your own Anthropic API key. It is stored in the Android keystore, kept out of device backups, and sent to Anthropic and nowhere else. They bill you directly for what you use; we take no cut and never see it.

What it can reach

Only what you list

An analysis may read only the hosts you ticked, and only read them. There is no tool that writes, logs in or submits anything. A page that tells the agent to go somewhere else is refused by the code, not by the model.

What it costs

A capped amount, every time

Every analysis has a hard ceiling on steps, tool calls, tokens and minutes, and the report says which one stopped it. A run that is cut short is labelled short rather than presented as finished.


Download.

Signed by Seraf Inc. The Play listing is on its way; the APK here is the same build.

Android

Free, no account

Android 7.0 and up · tech.seraf.raqib · 58 MB

Download APK

Android warns about anything not installed from Play. That is the warning working, not a problem with the file. Allow your browser to install apps, once, and it will proceed.

Linux

One command, no sudo

curl -fsSL https://skopia.sh | sh

x86_64 · 20 MB · installs into your home folder and your app menu, and checks the download's SHA-256 before unpacking it. Read the script first if you like.

WiFi, Bluetooth, sites and domains all work on Linux. The checks on the phone itself, and AI analysis, are Android only. To remove it: curl -fsSL https://skopia.sh | sh -s -- --uninstall.

Feedback

Tell me what is missing

This is early and being worked on full time. If a check is wrong, or the one you need is not there, say so: [email protected].