lsof stops at "bound to 0.0.0.0", which is a claim, not a fact. And on a dev machine, fifteen Python servers all report the same name; the port number tells you nothing about which project is which. PortWatch had to prove reachability and recover identity, on remote Macs too, without an agent installed anywhere.
Three Python files; the scanner and dashboard are stdlib only. One shell round trip per host gathers sockets, process table, firewall state, and IP, and the same probe string runs locally or over ssh. Ports get named by asking each server what it calls itself: page title, JSON body, package.json, serving folder. Then a second pass opens real TCP connections from outside, so REACHABLE means something answered. Stop and Restart come with guardrails: PID-reuse verification before any signal, server-side argv re-quoted through shlex, and a loopback-only dashboard with a per-run token against DNS rebinding.
In the menu bar every day. The glyph reads the count that matters: three ports answered from the LAN, or a checkmark for quiet. A full local scan takes about 250 ms, and the same table covers every Mac in the house.