No, there is no discovery tool. That said, if you are on the same layer2 segment as an ePMP radio you can always access it at it's default IP of 169.254.1.1 (unless you disable this feature). Firmware as of 2.6 includes LLDP as well, which can be turned on under Configuration -> Network.