PrivBeacon On-Prem Scanner Agent

Lightweight privacy-signal scanner for air-gapped networks, home labs, and Raspberry Pi. Zero npm dependencies. Node.js 18+.

Requires Pro or Enterprise for dashboard setup, agent API keys, and cloud sync. Local scans and JSON export work without an account.

This agent screens static HTML for trackers, consent UI, and policy language. A high score is not a legal certification (GDPR/CCPA or otherwise).

What it checks

The agent is a static (no-Playwright) port of the website scanner, sized for small devices:

• Tracker database plus inline snippets (gtag, fbq, _paq) and first-party /gtm.js-style paths
• Third-party hosts, consent banners, privacy / Do Not Sell links
• Privacy, cookie, and legal page probes
• 16 regional keyword/presence signals using the same scoring formula as the cloud engine
• Optional GPC (Sec-GPC: 1) comparison of the first HTML response
• LAN / IoT notes (HTTP-only devices, session cookies, HTTP auth)

It does not run a headless browser, so JavaScript-only banners, CNAME cloaking, and requests created after load may be missed. That is the tradeoff that keeps RAM around 50–80MB on a Pi.

Quick start

git clone https://github.com/Vassbrekke/PrivBeacon-On-Prem.git
cd PrivBeacon-On-Prem

node index.js scan --url http://192.168.1.100
node index.js scan --subnet 192.168.1.0/24 --iot-mode
node index.js serve --port 8080

Sign in to PrivBeacon on Pro or Enterprise, then open Dashboard → On-Prem for your API key.

Commands

node index.js scan --url https://example.com
node index.js scan --url http://192.168.1.1 --insecure   # self-signed IoT TLS (LAN only)
node index.js scan --url http://192.168.1.1 --laws gdpr,ccpa
node index.js scan --subnet 192.168.1.0/24               # /24 only, ports 80+443
node index.js scan --subnet 192.168.1.0/24 --iot-mode    # also 8080/8443
node index.js scan --url http://192.168.1.100 --sync
node index.js sync                                       # push unsynced reports
node index.js export --format json
node index.js serve --port 8080                          # localhost UI

--insecure disables TLS certificate checks. It is limited to private/LAN hosts unless you pass --insecure-any.

Hardware

Device	RAM	Storage	Notes
Raspberry Pi 4	512MB+	1GB SD	Recommended
Raspberry Pi 3	1GB	1GB SD	Works, slower subnet scans
Any Linux x64	256MB+	100MB	Docker/VM

Subnet scans are limited to IPv4 /24–/32 with 2 concurrent hosts so a Pi is not overwhelmed.

Cloud sync (optional)

Reports stay in data/reports.json until you sync. The cloud stores the agent's results — it does not try to re-fetch LAN IPs. Synced payloads include the URL, tracker/consent findings, scores, and a short HTML snippet.

export PRIVBEACON_API_KEY=pb_live_your_key
export PRIVBEACON_SYNC_URL=https://privbeacon.com/api/v1/agent/sync
node index.js scan --url http://192.168.1.100 --sync
# or later:
node index.js sync

You can also put those variables in .env. Each synced host uses one dashboard scan credit and appears as an On-prem site. Agent scans cannot earn the public Certified Private badge.

Local UI on the Pi

node index.js serve --port 8080
# http://127.0.0.1:8080

To listen on the LAN, set a token (required). The token would otherwise travel in cleartext over HTTP, so use TLS or a reverse proxy:

export PRIVBEACON_AGENT_TOKEN=a-long-random-string
node index.js serve --host 0.0.0.0 --port 8080 \
  --tls-cert /path/to/cert.pem --tls-key /path/to/key.pem

Air-gapped workflow

1. Install on the isolated network
2. Scan URLs or the local /24
3. node index.js export --format json > report.json onto USB
4. Or connect later and node index.js sync

License

GPL-2.0. Copyright (C) 2026 Vassbrekke AS.

Related

• Product: privbeacon.com
• Guide: On-prem scanner agent
• Operator: Vassbrekke AS