/portscan

description: Port scanning with fast discovery and detailed service enumeration
allowed-tools: ToolSearch, Bash, Read, Write
argument-hint: <target-ip-or-domain>

> **Storage Policy**: ALL output files MUST be saved in the project directory. NEVER write to `/tmp/` or any system temporary directory.

Port Scan

Target: `$ARGUMENTS`

Execute a two-phase port scan using Hexstrike MCP tools.

Step 1: Load Tools

Use ToolSearch to load:

• `rustscan_fast_scan` — ultra-fast port discovery
• `nmap_advanced_scan` — detailed service/version/script scanning

Step 2: Fast Discovery

Run `rustscan_fast_scan` against the target with a high batch size for speed. This identifies all open ports quickly.

Step 3: Detailed Enumeration

Take the open ports discovered by RustScan and run `nmap_advanced_scan` against only those ports with:

• Service version detection (`-sV`)
• Default NSE scripts (`-sC`)
• OS detection if possible (`-O`)
• Appropriate timing template (T3 for remote targets behind WAF, T4 for direct targets)

Step 4: Results

Present findings as a table: | Port | Service | Version | Notes | |------|---------|---------|-------|

Save detailed results to `portscan-{target}.md` in the project directory.

Flag any interesting findings: unusual ports, outdated versions, services with known CVEs.