Raqib

رقيب raqīb — the one who keeps watch

The room is quiet
until you listen.

Press one button. Raqib sweeps the WiFi you are standing on, sits with the Bluetooth advertisements in the air around you, and checks the sites you own — then tells you what it heard, in sentences.

One Android app. One payment. Nothing renews.

Join the launch list See what it hears
Listen
About twelve seconds, start to answer
WiFi
254 addresses, 32 at a time, 400 ms a probe
Bluetooth
Advertisements only — it never connects
LISTENING Aug Home 5G · 192.168.1.0/24

You are on Aug Home 5G. 8 devices on WiFi. 2 look risky — worst is Telnet is open (port 23). 5 Bluetooth gadgets nearby. One of them looks like a tracker tag. 1 of your sites has something to fix.

On WiFi
8
Bluetooth
5
Worth a look
3
the app’s own words, from its own briefing

Three things are talking. Raqib listens to all of them.

Jetpack watches WordPress sites and bills you monthly. Fing watches networks and steers you toward a subscription and a dongle. Neither of them hears the tracker tag in your coat pocket. These are the same question asked in three places — what is around me, and is any of it a problem — and nobody answers all three in one app.

WiFi · the network you are on

See who is on your WiFi

Every address on the local /24 gets a TCP connect probe. A refused connection proves a host exists just as surely as an accepted one — that distinction is what makes the sweep fast and permission-free. mDNS and reverse DNS then put names to whatever answered.

Local network8 devices
  • 192.168.1.1 · Router80 443 53
  • 192.168.1.47 · Camera554 23
  • 192.168.1.211 · Unidentified5555
  • 192.168.1.102 · NAS445 548 2049
  • 192.168.1.37 · This device—
Findings2 exposed
CRITICAL Telnet is open (port 23)

Telnet sends passwords in plain text and is the single most common way cheap IoT devices get recruited into botnets. Disable it.

CRITICAL Android Debug Bridge is open (port 5555)

Anyone on this network can install apps and read data on that device without any prompt.

Nine risky services are catalogued in plain language — Telnet, FTP, ADB, SMB, RDP, VNC, Redis, MongoDB, UPnP.

Radio · the air around you

Who is advertising nearby

Phones, earbuds, tags and TVs shout their presence over Bluetooth constantly, to anything willing to listen. Raqib listens, works out what each one probably is, and flags the ones that match a finder-network tag. It does not connect to any of them.

Bluetooth5 advertising
  • Earbuds or headphones−52 dBm
  • Tracker tag−41 dBm
  • Watch or band−67 dBm
  • TV or streamer−74 dBm
  • Bluetooth gadget−88 dBm
Findings1 worth a look
MEDIUM Looks like a tracker tag

This advertisement matches a finder-network tag — AirTag, SmartTag, Tile and similar. Harmless if it is yours. Worth checking if you did not bring one in.

Twelve seconds of listening, strongest signal per device wins. No pairing, no GATT, nothing written.

Sites · what you publish

Your own certificates and headers

A check follows the redirect chain by hand, reads the certificate off the socket, looks for six response headers, scans the first 512 KB for mixed content, and notices when a server volunteers its own version number. Every fault carries a penalty, and the penalties make the grade.

Siteschecked 14:22
  • seraf.devC 76 · UP · 142 ms
  • old.example.comF 17 · DOWN · 500
Findingsseraf.dev · 3
HIGH Missing Content-Security-Policy

Without it, one injected script tag is enough to take over the page. Costs 15 points.

MEDIUM Certificate expires in 24 days

Worth confirming auto-renewal is actually working. Costs 10 points.

Grades are arithmetic, not opinion: 100 minus every penalty, floored at zero. A is 90 and up.

It answers in whichever language you speak.

Most security tools make you choose between being patronised and being buried. Raqib has one switch, and it changes only the words. Simple is sentences about the room you are in. Advanced is the addresses, ports, signal strengths and service UUIDs underneath them. Same scan, same findings, nothing withheld — this is a speaking mode, not a paywall.

The switch above changes the panel beside it, exactly as it does in the app. Nothing is hidden from the beginner and nothing is dumbed down for the specialist; the specialist just gets the figures instead of the sentence built from them.

It is a per-device setting, remembered between sessions, and it applies everywhere at once — Listen, WiFi, Radio and Sites.

You are on Aug Home 5G. 8 devices on WiFi. 2 look risky — worst is Telnet is open (port 23). 5 Bluetooth gadgets nearby. One of them looks like a tracker tag. 1 of your sites has something to fix.

  • SSIDAug Home 5G
  • BSSIDa4:2b:8c:11:04:9f
  • Gateway192.168.1.1
  • You192.168.1.37
  • LAN hosts8
  • Exposed192.168.1.47:23 · 192.168.1.211:5555
  • BLE adv5 unique · strongest −41 dBm
  • Tracker0x004C · finder-network payload
  • Sitesseraf.dev C 76 · old.example.com F 17

This page, graded by Raqib’s own rules.

The six headers below are the ones the app looks for, carrying the same penalties it applies. Your browser measured this response a moment ago. It is not a screenshot, and we cannot cheat it without cheating you.

· -- / 100

measuring…

What a browser cannot show you

The certificate is the other half of the check, and no script can read it. Expiry dates, issuer, the moment a renewal quietly failed — those come off the TLS socket, which only a native client gets to hold. The same is true of every other channel: a web page cannot open a LAN socket or hear a Bluetooth advertisement. That is the whole reason Raqib is an app.

This page’s certificate: readable by Raqib, not by this page.

One half of this cannot run on your phone.

Listening is on-device by necessity: no server can see your living room. Waiting is the opposite. Android’s periodic work has a hard fifteen-minute floor, and Doze defers even that once the screen has been off a while — which is exactly the window an overnight outage lives in. An app that notices your site is down when you next unlock your phone is not a monitoring product, so the waiting runs somewhere that never sleeps and arrives as a push.

Where each half of Raqib runs On the device: the WiFi sweep, the Bluetooth listen and on-demand site checks, because no server can see a home network or hear a Bluetooth advertisement. On a Cloudflare Worker, designed but not yet built: a cron tick every minute selects the sites whose next check is due, fetches each one, writes the result to D1, and pushes to the phone only when a site changes state. on the device always on Your phone WiFi sweep · 254 addresses Bluetooth listen · 12 seconds Site check, on demand TLS certificate, off the socket No server can see your living room or hear what is advertising in it. Cloudflare Worker not built yet cron * * * * * SELECT sites WHERE due fetch(site.url) D1 result row, next_check_at always push only when a site changes state

On the device

The WiFi sweep, the Bluetooth listen, device classification, and any site check you ask for by hand. None of this can be done from a server, and an on-demand check is already instant.

shipping

On a Worker

One cron tick a minute pulls the sites whose next check is due, fetches each, writes the result, and pushes only when the state actually changes. No queue, no VM, no per-user isolation. A missed minute is picked up by the next tick.

designed, not built

What the platform will not let anyone do.

Fing’s older reviews are full of people asking where the MAC addresses went. No Android app has been able to read them since Android 10. Raqib says so on the screen rather than leaving a field blank and letting you assume it is broken.

No ping, anywhere
An unprivileged app cannot open a raw socket, so ICMP is off the table. Discovery is a TCP connect sweep instead, and a refused connection is just as good a proof of life as an accepted one.
No MAC address, so no vendor name
/proc/net/arp stopped being world-readable in Android 10 and there is no public API for a neighbour’s hardware address. Devices are identified by their open ports, their mDNS advertisement and their reverse DNS name.
Bluetooth is a microphone here, not a hand
Raqib reads advertisements and stops. It never pairs and never opens a GATT connection — the moment it did, it would be a radio that writes, and that is a different app with a different store review. It also cannot list your already-paired classic devices; that needs to be a system app.
The network’s name is behind location permission
Android gates SSID, BSSID and the gateway address behind precise location, and Bluetooth scanning needs its own grant. Refuse either and the rest still runs — Raqib just loses the ability to tell one network from another, which is what “a new device on this network” depends on.

Pay once. Keep what you paid for.

Raqib is a one-time purchase with twelve months of new features. When the window closes nothing is taken away and nothing is charged — every feature you had on the last day is yours for good. This is how JetBrains sells software, and it is the opposite of how monitoring apps usually do.

Free

$0

  • Unlimited WiFi sweeps
  • Unlimited Bluetooth listening
  • Device identification and findings
  • Simple and Advanced, both
  • One monitored site, checked every six hours

Listening is the whole app, not a teaser. It is free because it costs us nothing to run — it runs on your phone.

Pro

$12.99 once

  • Everything in Free
  • Five monitored sites
  • Checks every five minutes
  • Deep port scan, 44 ports per device
  • Alerts when a new device joins
  • Twelve months of new features

Regional pricing on. Not a subscription — there is nothing to cancel, because nothing renews.

Why five sites, and why five minutes

A site checked every five minutes is about 8 600 checks a month, and those checks run on somebody’s server for as long as you own the app. A single payment can only cover a bounded amount of that. The two caps are a price, written in the units the cost is actually incurred in — not a nag designed to sell you an upgrade. Everything that runs on your own phone is uncapped, because it costs us nothing.

What the twelve-month window covers From the day of purchase, twelve months of new features are included, and anything released inside that window is yours permanently. After it closes, nothing renews and nothing is removed — the app you have keeps working, and later features simply are not added. you buy +12 months every feature released in here is yours, permanently nothing you have on the last day is ever taken back nothing renews · nothing is charged later features are simply not added

Being built

  • next
    Real Play Billing

    Today the purchase path is a stub that grants Pro for free. It does not ship in that state.

  • next
    Scheduled uptime checks

    The Worker, its database, and the push that wakes you at 04:00 when a certificate lapses.

  • after
    Background listening

    Telling you a new device joined, or an unfamiliar tag has been following you, while the app is closed — inside what Android actually permits.

  • after
    Flipper Zero, as a sensor

    Sub-GHz jamming detection is the one worth having: car-key and alarm jamming is a real physical attack that no phone can see on its own. Plus a read-only badge audit that tells you your office fob is 1980s technology.

Never being built

Raqib reports what it can hear from where you are standing. It does not act on it. That line is not marketing — it is what keeps the app on the store, and it is the only defensible place to draw it.

  • No connecting to a Bluetooth device it found. It listens; it does not touch.
  • No deauthentication frames. Detection only.
  • No replaying captured Sub-GHz or NFC.
  • No password guessing, no brute force, no credential stuffing.
  • No exploiting a finding it reports. It tells you the door is open; it does not walk through it.
  • No scanning networks you are not connected to.

Every radio feature above listens. None of them transmit.

Tell me when it is on the Play Store.

One message when Raqib is published, and one more if something changes that a person on this list would want to know. No newsletter, no drip. Addresses expire on their own after 180 days.