A black-box service with a poorly documented and obfuscated SDK prompted the creation of grpc-scan. The tool automates the enumeration of gRPC services by exploiting error message variations caused by invalid requests, since standard discovery methods are unavailable. gRPC's binary nature and case-sensitive requirements make manual enumeration difficult, needing the exact service and method names, and properly serialized messages. The tool fingerprints the gRPC protocol and generates likely service and method name combinations based on observed patterns. It identifies subtle differences in error codes returned by different gRPC implementations. The tool multiplexes requests to improve scan speed by establishing multiple connection with services. Pentests often reveal service sprawl from migrations, method proliferation with inconsistent authentication, and unexpected exposure of internal services. Older services often lack security controls present in newer implementations, leading to vulnerabilities. Organizational history is also revealed via package namespace discovery, exposing varying security assumptions. Limitations include the inability to automatically craft specific protobuf structures for services, and a current focus on unary calls.