Transom

Signature List

Transom looks for a small, explicitly maintained set of software fingerprints — not an internet-wide sweep. This page publishes that set in full so anyone can audit exactly what we detect and how. 2 signatures are active; the rest are being validated for false-positive rate before they collect data.

Every marker below is passive: it is visible in a response any client would receive from an unauthenticated request. Where a protocol handshake is needed to disambiguate, we send only the connection banner and read only the metadata it returns. See the methodology for the full stance.

MCP — Streamable HTTP / HTTP+SSE transport

Active · MCP transports

An HTTP endpoint speaking the Model Context Protocol over the current Streamable HTTP transport or the legacy HTTP+SSE transport.

Passive indicators

  • A response `Content-Type: text/event-stream` on a GET to a conventional MCP path (`/mcp`, `/sse`, `/messages`, `/api/mcp`, `/mcp/sse`).
  • A JSON-RPC 2.0 shaped error body (`{"jsonrpc":"2.0","error":{"code":-32600,…}}`) returned to a plain GET or malformed POST.
  • An `MCP-Protocol-Version` response header.
  • `Server: uvicorn` (or another ASGI banner) combined with any of the above — a Python FastAPI/Starlette MCP implementation.

Handshake we may send

A single JSON-RPC `initialize` request (the protocol's connection banner). We read only the returned `protocolVersion`, the boolean `capabilities` flags, and `serverInfo` (name + version). This is equivalent to a TLS ClientHello or an SSH banner grab — it causes no action and discloses no tools.

What we never send

  • `tools/list`, `resources/list`, `prompts/list` — no capability enumeration.
  • `tools/call`, `resources/read` — no invocation of anything.
  • Any authentication, including empty or default tokens.

What Transom records

  • Transport variant (Streamable HTTP vs legacy SSE)
  • `protocolVersion` and which capability flags are advertised
  • `serverInfo` name and version, if returned
  • Whether the `initialize` handshake completed without any credential
  • ASGI/server banner, ASN, country, first-seen / last-seen
Added 2026-09-08Reviewed 2026-09-08Exposed by Design (arXiv 2608.00150)Knostic — Mapping MCP Servers Across the InternetMCP spec — Transports

LiteLLM proxy

Active · LLM gateways

The open-source LiteLLM proxy — an OpenAI-compatible gateway that fronts multiple model providers and holds their API keys.

Passive indicators

  • `/health/liveliness` returns the literal string `I'm alive!`.
  • `/health/readiness` returns JSON containing a `litellm_version` field (unauthenticated by default).
  • `/` or `/docs` serves a Swagger UI titled `LiteLLM API`; an admin UI at `/ui`.
  • The auth-error body on `/v1/models` when a master key IS set: `{"error":{"message":"Authentication Error…","type":"auth_error","code":"401"}}`.

What we never send

  • `/v1/chat/completions`, `/v1/completions`, `/v1/embeddings` — these invoke a model and cost the operator money.
  • Any request carrying a key, including a guessed master key.

What Transom records

  • Software = LiteLLM, version (from `/health/readiness` when exposed)
  • Whether `/v1/models` returns a model list with no credential (the exposure signal)
  • Whether the admin UI and API docs are reachable
  • ASN, country, first-seen / last-seen
Added 2026-09-08Reviewed 2026-09-08LiteLLM — health & readiness endpointsLiteLLM Proxy Security Hardening

vLLM OpenAI-compatible server

Under evaluation · LLM gateways

vLLM's OpenAI-compatible API server — commonly deployed with no authentication and an OpenAI-shaped surface.

Passive indicators

  • `/v1/models` returns an OpenAI-shaped `{"object":"list","data":[{"id":…,"owned_by":"vllm"}]}`.
  • `/version` returns `{"version":"…"}`.
  • Swagger UI at `/docs` titled `vLLM API server`; `Server: uvicorn`.

What we never send

  • `/v1/chat/completions` or `/v1/completions` — model invocation, consumes GPU time.

What Transom records

  • Software = vLLM, version, served model id(s) advertised on `/v1/models`
  • Whether the surface is reachable with no credential
  • ASN, country, first-seen / last-seen
Added 2026-09-08Reviewed 2026-09-08vLLM — OpenAI-compatible server

Ollama

Under evaluation · Self-hosted model runtimes

The Ollama local model runner, bound to a public interface instead of loopback. No authentication exists in the product.

Passive indicators

  • `/` returns the literal string `Ollama is running`.
  • `/api/tags` returns `{"models":[…]}` with no authentication.
  • Default port `11434`.

What we never send

  • `/api/generate`, `/api/chat` — model invocation, consumes the operator's GPU/CPU.
  • `/api/pull`, `/api/delete` — these change state on the host.

What Transom records

  • Software = Ollama, version (from `/api/version`)
  • Count of models present (not the list itself, on the public site)
  • ASN, country, first-seen / last-seen
Added 2026-09-08Reviewed 2026-09-08Ollama API reference

To propose a signature, or to have your software's detection reviewed, email contact@transomsecurity.com.