vernette/warpscout

What it does

Cloudflare WARP has thousands of endpoint addresses, and the address you connect to decides which Cloudflare edge node your tunnel lands on. That affects filtering: traffic through some nodes is inspected or blocked. The official WARP client does not let you pick a node, so WARPSCOUT sweeps endpoint addresses, reports the exit region (SEEN AS) and edge node (NODE) for each one, and can write a config for the best endpoint.

It runs as a single binary with no admin rights and no TUN device, supports Windows, Linux, macOS, Android/Termux, router firmware and Docker, and shows a live scanning table plus a report file on disk. Scans cover wg (WireGuard), awg (AmneziaWG), masque and masque-h2 protocols.

Quick start

On Windows, download the windows_amd64.zip from the releases page, unpack it, open a terminal in that folder, and confirm the binary runs:

.\warpscout.exe version

On Linux, macOS, OpenWrt and Termux, the provided install script places the binary in a per-platform directory:

curl -fsSL https://raw.githubusercontent.com/vernette/warpscout/master/install.sh | sh

Alternatively, with Go 1.25 or newer: go install github.com/vernette/warpscout@latest.

Then create a WARP account once, which writes warpscout-account.json next to the binary; scanning will not start without it:

.\warpscout.exe register

Scan endpoints using AmneziaWG and in-tunnel latency/packet-loss checks:

.\warpscout.exe scan -p awg -P

Pick a row where the node is not DME, LOSS is 0% and ping is low, or let the tool choose and emit a config for the best endpoint:

.\warpscout.exe scan -p awg -P -exclude-node DME -conf warp.conf

Import the resulting .conf into an AmneziaWG client. With -p wg, the output is a plain WireGuard config. macOS blocks the first run of a downloaded binary until the quarantine flag is cleared with xattr -d com.apple.quarantine warpscout.

Constraints

• A WARP account file is required before any scan; registration is a separate first step.
• -P adds in-tunnel latency and loss measurement and takes longer, but it is the only way to detect endpoints that connect and are then cut mid-stream (torn down).
• On filtering networks plain -p wg may find nothing, so the docs recommend starting with -p awg.
• The -speed column runs a download test and slows scans noticeably.
• Android users are pointed to a separate APK project; the AUR packages are maintained outside this repository.
• The license is MIT. The README notes the project is distributed through community channels and credits third-party implementations for several protocol pieces.

HotRepo's take

On the 2026-11-13 Go daily list the project recorded 12 new stars, ranking 12th in that language list at 643 total stars. That is a single snapshot, so it supports only that day's position, not a trend. The readme's own rationale — that node choice matters because of DPI filtering at specific Cloudflare nodes — is a concrete problem statement that matches the tool's scan-and-report design; the ranking record is too thin to add more.