SenPaiScanner: The Go Tool That Turns Cloudflare IPs Into a Ranked Trust Funnel
A TUI-first scanner that filters noisy edge nodes with staged probes, jitter-aware scoring, neighbor expansion, and full Xray validation.
- SenPaiScanner is really a decision system that ranks confidence, not a brute-force scanner that just sprays requests at Cloudflare IPs.
- Its main trick is to spend cheap probes first, then reserve full Xray validation for the few candidates that already look stable.
- Jitter matters because a proxy endpoint that stays consistent is often more useful than one that only looks fast in a single test.
- The TUI is part of the product, because it keeps a complex staged pipeline usable in a single terminal workflow.
The Real Product Is Not Discovery. It Is Confidence.
SenPaiScanner starts with a simple bet: the value is not in finding the most IPs, it is in shrinking a noisy search space into a shortlist you can trust. That is why the project feels less like a scanner and more like a staged filter for proxy candidates.
The repo description is blunt about the premise: "A light-weight scanner for Cloudflare IPs, written in Golang." But the implementation goes further than that line suggests. It does not stop at reachability. It ranks, re-checks, expands around hits, and only then calls in Xray for full validation.
A Two-Stage Pipeline That Saves the Expensive Work for Last
The architecture is intentionally layered. Phase 1 does the cheap work: generate candidates, probe them with budgeted TCP, TLS, and HTTP checks, and score the survivors. Phase 2 is narrower and heavier. It turns only the strongest candidates into real proxy configs and hands them to xray-core.
// Phase 1 narrows the field before Phase 2 validates the winners.
for ip := range candidates {
if !probe(ip) {
continue
}
score := rank(ip)
if score.IsStrong() {
enqueueForXray(ip)
}
}That split matters because it changes the economics of the scan. The tool is not trying to prove everything up front. It is trying to prove just enough to make the next expensive step worth it.
Neighbor expansion is the subtle trick
One hit can create a small cluster search. When the scanner finds a working IP, it can sample nearby addresses, looking for the kind of subnet-local stability that simple one-off checking misses. That makes the repo feel opportunistic in a good way. It learns from a success instead of treating every address as isolated.
Why Jitter Beats Raw Speed
A single fast ping can flatter a bad endpoint. SenPaiScanner’s result layer cares about consistency. Jitter, in this context, is the distance between a connection that looks fast once and a connection that keeps behaving under load.
That is a better proxy for real use. Proxy endpoints fail in boring ways. They stall, wobble, and degrade before they collapse. A stability-aware score gives the tool a way to rank for usable behavior instead of vanity latency.
A light-weight scanner for Cloudflare IPs, written in Golang.
That README line is understated, but the code tells a richer story. The scanner is not just lightweight because it is written in Go. It is lightweight because it uses cheap evidence first, then spends compute only where the odds improve.
The Engine Is a Concurrency Throttle, Not a Firehose
The engine is built to move hard without turning the terminal into chaos. A semaphore pattern keeps concurrency bounded. Atomic counters let the TUI update live state without dragging the whole scan into lock contention.
type Engine struct {
sem chan struct{}
inFlight atomic.Int64
healthy atomic.Int64
failed atomic.Int64
}
That is the right shape for this job. The scanner can be aggressive in the background while the interface stays responsive in the foreground. The point is not maximum fan-out at all costs. The point is steady pressure with visible feedback.
Why the TUI Is Not Just Decoration
Bubble Tea is doing real work here. A terminal UI makes the pipeline feel inspectable. You can watch live tables, update actions, and move through results without juggling a pile of flags or external dashboards.
That matters because the user is not just launching a job. The user is steering a search process. The TUI makes that process legible, and legibility is part of trust.
| Tool | Platform | UI style | Validation depth | Stability awareness | Notable differentiator |
|---|---|---|---|---|---|
| SenPaiScanner | Go, cross-platform | Terminal UI | Staged probe plus Xray | Yes, jitter-aware | Discovery, ranking, and final validation in one loop |
| Cloudflare-Clean-IP-Scanner | Go or forked variants | CLI oriented | Latency and speed focus | Limited | Fast scanning and simple filtering |
| IPCleanScanner | Windows | Graphical UI | Proxy testing focus | Usually lighter | GUI-first workflow for v2rayN users |
The comparison is less about winners than about workflow shape. SenPaiScanner is the most complete loop because it does the discovery, the ranking, and the end-to-end verification in one place.
The Maintainer, the Niche, and the Ecosystem
This repo belongs to a specific toolchain, not a generic networking category. It sits in the internet-freedom ecosystem, where speed, stability, and frictionless distribution matter because the operating environment is hostile by default.
That is also why the project’s Go stack makes sense. Static binaries, cross-platform builds, and a compact runtime fit the job. MatinSenPai is building for people who need something they can run, inspect, and move across machines without ceremony.
