Discovery and Xray validation solve different problems
A Cloudflare address that works on one ISP may be slow, filtered, or unreachable on another. SenPai Scanner samples Cloudflare IPv4 ranges or reads addresses from a file, probes configurable ports, and records health, latency, loss, throughput, location, and status. This is endpoint discovery for a particular network, not a general security scanner.
A quick edge response does not prove the full proxy path works. SenPai can parse a VLESS, Trojan, or VMess link, derive SNI, host, path, transport, TLS, and port settings, then use an embedded Xray process to validate shortlisted addresses. TCP, WebSocket, gRPC, and XHTTP or SplitHTTP configurations are documented. That two-stage design avoids running expensive end-to-end tests against every random candidate.
Users can inspect and copy healthy results while discovery continues, stop when the shortlist is large enough, then speed-test only that set. Cancellation preserves earlier results. Every measurement is local and temporary, because ISP routing, filtering, Cloudflare load, wireless conditions, and the upstream proxy can all change after the scan.
Three interfaces use the same Go scanning engine
The desktop application runs on Windows, Linux, and macOS. Android 7 or newer gets a native Material interface, while the terminal UI supports desktop systems and Linux ARM64 in Termux. Running on the actual device and connection is useful here; a fast address measured on a server elsewhere may say little about a filtered mobile network.
The release publishes 6 CLI targets, 4 desktop GUI archives, and 3 Android APK choices. SHA256SUMS.txt lets users verify downloads. Android packages have a signing caveat: a future APK signed with another certificate cannot update the installed app in place. The README is English-first and links a Farsi translation for its core community.
What happened when we ran it
Our sandbox installed dependencies for commit c33b0b3 in 44 seconds and counted 251 Go packages. The build completed successfully in 75 seconds. The test command finished in 25 seconds with 7 passed and 0 failed out of 7. This was an unprivileged Debian container with 3 CPUs, 8 GB of RAM, Go 1.24, and no secrets.
The checkout contained 119 files, about 26,144 source lines, and occupied 7 MB. We found 5 CI workflow files, no Dockerfile, and no separate tests directory. A small test count does not exercise every desktop, Android, ISP, and proxy combination, but this is the only project in this seven-repo set whose supplied install, build, and test steps all completed successfully.
The build result supports the CLI and shared Go code in our environment. It does not prove the Wails GUI, Android APK, embedded Xray behavior, or live endpoint quality because our lab block records no such run. Those need the published artifacts or their platform-specific toolchains and a network you are permitted to test.
Exports remove error-prone manual host replacement
A validated endpoint can be copied as IP:port, inserted into the original share URL, encoded as a Base64 subscription, or exported as Sing-box JSON and Clash YAML. This avoids manually editing encoded configuration fields after each scan. Results and exports have separate workspaces, so making a client file does not discard the live result table.
File mode accepts plain IPv4 addresses, the first field in a CSV line, or CIDR ranges. Weighted random sampling covers embedded Cloudflare ranges. Neighbor scanning explores addresses around successful candidates, but is disabled until the user opts in. Start with modest worker counts and a known port, then expand only if the baseline behaves predictably.
Proxy links may contain user IDs, passwords, hosts, and paths. Keep them out of screenshots, issues, logs, and sample files. Run SenPai on a trusted device, check where it writes exports, and redact configurations before requesting support. The project's responsible-use note also requires authorization for the ranges and networks being scanned.
Screen readers and one Android 10 device remain open gaps
Issue 125 comes from a blind Windows user who says the Bubble Tea full-screen interface is difficult or unusable with NVDA and JAWS. Alternate-screen rendering, continuous redraws, menus, and live result tables are the problem; there is no line-by-line accessible mode. That is a concrete reason to reject the CLI if a screen reader is required.
Issue 126 reports a Redmi 9C on Android 10 and MIUI 12 crashing just after the main screen appears. The reporter tried the universal and 32-bit APKs, reinstallation, cleared data, permissions, several networks, and a disabled VPN. One report does not establish a general Android defect, but owners of similar devices should test before relying on the app.
The repository was pushed on August 3, 2026, the same day v1.0.0 was released. GitHub showed 2,339 stars and 42 open issues and pull requests combined. That is an active niche audience around a first stable release, not a long compatibility record. Use the interface that works on your device, verify the downloaded artifact, and treat every exported endpoint as a result to recheck rather than a permanent answer.