رقيب raqīb — the one who keeps watch
One button. Raqib scans your WiFi, listens to the Bluetooth advertisements around you, and checks the sites you own — then says what it found in plain English.
Android and Linux. $4.99 once — no account, no subscription.
You are on Aug Home 5G. 9 devices on WiFi. Worst: Telnet open on port 23. 19 more findings. 5 Bluetooth gadgets nearby. 2 sites on file.
Listen answers in a paragraph. The other three are the same scan with everything visible. The switch changes the words, not the data — both are free.
ListenOne button. One paragraph.Adds SSID, BSSID, gateway and your own IP.
WiFiEvery device on the network.Adds each device's IP address.
RadioWhat is advertising nearby.Adds MAC or UUID, RSSI and company ID.
SitesCertificates and headers.Adds the redirect chain and penalties.
Screens from the app. The network in them is a fixed example, not yours.
Nothing else ships all four. Jetpack does sites and bills monthly; Fing does networks and sells a dongle; neither hears a tracker tag, and neither looks at the phone in your hand.
WiFi
TCP connect probe across your local /24. Names devices from mDNS and reverse DNS, then flags the ones exposing something.
Bluetooth
Twelve seconds of listening to BLE advertisements. Identifies each device and flags anything matching a finder-network tag.
Sites
Follows the redirect chain by hand, reads the certificate off the socket, checks six security headers. Scores 0–100.
This phone
The other three look outward. This one looks at the phone itself — the settings that decide how much the rest of it matters.
These are the six headers the app checks, with the same penalties. Your browser measured this page's response a second ago — the grade below is a live measurement, not an image.
Headers, like the six on the left. The certificate off the TLS socket — issuer, expiry, days remaining. Devices on the WiFi you are connected to. Bluetooth advertisements in the room. Findings, each with a fix.
Install the app to run the same grader on a site you own.
Not on the Play Store yet. Download the APK and install it directly — Android will ask you to allow installs from your browser the first time. There is a Debian package for the desktop build too.
Signed by Seraf Inc. — SHA-256
bd53 d52f 0b4d 599f 5f41 9bd0 18d1 61ad ba23 ff2c d5c5 17a7 b249 890f 8b23 f2b9.
Check before you install: apksigner verify --print-certs raqib-android.apk.
An APK reporting CN=Android Debug is not ours — that key is
public and anyone can sign with it.
curl -fsSL -o /tmp/raqib.deb "https://gitlab.com/api/v4/projects/86137914/packages/generic/raqib/latest/raqib_amd64.deb" sudo apt install /tmp/raqib.deb
Buy it on Google Play and it is yours. There is no account, no subscription, no in-app purchase and no tier — everything Raqib does, it does from the moment you install it.
$4.99 one payment
Google handles the payment, the refund window and regional pricing. We never see a card, and there is nothing to cancel.
Because nothing here runs on a server, so nothing costs us anything per month to keep running.
No account means nothing to breach. No server means nothing to shut down. The app you buy keeps working whatever happens to us.
No. One payment of $4.99 on Google Play and you have all of it. There is no account, no in-app purchase, no licence key and no tier — the app contains no billing code at all. Google handles the payment and the refund window; we never see a card.
The scans do not. Your network, your devices and your Bluetooth surroundings are read on the device and stay there — there is no account, no sync and no analytics. The one exception is the scheduled uptime checking for sites you add, which by definition runs on a server, and only ever touches the URLs you typed in yourself.
Open ports, mDNS advertisements, reverse DNS. That is what Android gives an app on the LAN you are connected to.
A TCP connect sweep of this subnet — 254 addresses, 32 at a time. Bluetooth is twelve seconds of BLE advertisements. Sites are an HTTPS fetch from this device: certificate, six headers, redirects, a grade.
Android's periodic work has a hard fifteen-minute floor and Doze defers it further, so an overnight outage would go unnoticed until you unlock your phone. That half runs on a Cloudflare Worker and arrives as a push. It is designed and not yet built.
No. Sweep as often as you like, add as many sites as you like. Nothing here runs on a server, so nothing costs us anything per use — there is no reason to meter it.
What it heard, how sure it is, and a sentence for the fix. Telnet on a camera, a tracker-tag advertisement, a certificate with days left — each one names the setting or the change.
Real Play Billing and the scheduled uptime Worker are next. After those: background alerts for a new device or an unfamiliar tag, and Flipper Zero as a sensor — Sub-GHz jamming detection and a read-only badge audit. Every one of them listens; none of them transmit.
Android APK and a Debian package, both on this page. Apt:
sudo apt install raqib after adding the repo. iOS is not
shipping.
One message when it ships. No newsletter. Addresses are deleted automatically after 180 days.