Zero Breach Toolkit

Zero Breach is a local, read-only Python scanner for traces of the AdFection and Candiru ad-delivered spyware campaigns. It examines browser histories, cookies as host names and timestamps, caches, connection records, file fingerprints, per-user Windows COM registrations, known file paths, hosts-file entries, and DNS resolver data against published indicators, then grades findings as on-disk, persistence, contacted, DNS-record, configured, or referenced evidence. It can export indicator data and findings for STIX, MISP, and DNS or ad-blocking formats. Default checks use only the Python standard library, make no intentional network requests, require no administrator access, and run on Windows, macOS, and Linux; optional Candiru file-pattern checks require the pinned YARA-X engine. The project emphasizes that a clean result is not proof that a device is safe, because unsupported locations, unrecorded DNS activity, expired traces, and spyware designed to evade such checks remain outside its coverage. The scanner is licensed under Apache License 2.0, while its indicator data is released under CC0 1.0.

Mobile Verification Toolkit (MVT) is a command-line collection of forensic utilities developed and maintained by Amnesty International's Security Lab and other contributors. It analyzes forensic acquisitions from Android and iOS devices to identify traces that may indicate compromise, including scans against public indicators of compromise from Amnesty International and other research groups. Its platform commands are `mvt-ios` and `mvt-android`; the `mvt` command provides shared functions such as version reporting, shell completion, plugin management, and downloading indicators. MVT can be installed from source or PyPI and is intended for trained technologists and investigators rather than end-user self-assessment. Public indicators alone cannot establish that a device is clean, and the project is distributed under its own license.

ThreatXtension is an open-source security tool for analyzing browser extensions and detecting potentially malicious ones. It combines static analysis, permission analysis, VirusTotal intelligence, web-store information, and AI-based assessment.

sigwood is a local-first, command-line threat-hunting tool for self-hosters, developed as a Python package and distributed through PyPI. It analyzes logs already on the host, including Zeek, Pi-hole or dnsmasq, syslog or the systemd journal, and AWS CloudTrail, without an agent, daemon, database, network connection, or account. Its detectors cover periodic beaconing using an FFT over connection timing; anomalous DNS using HDBSCAN clustering; rare syslog events using Drain3 templating and rarity; authentication structure; port scans; bulk outbound transfers; protocol and TLS anomalies; unusual CloudTrail activity using a per-principal z-score composite; and behavior in names blocked by Pi-hole. The default hunt runs a curated subset, while individual detectors or all detectors can be selected explicitly. Commands also include digest for profiling logs, graph for producing a self-contained HTML flow artifact, init for writing configuration, and export and allowlist utilities. Findings identify the technique and supporting evidence, and are presented as leads for investigation rather than verdicts. The tool can read a directory or individual log file and supports text, HTML, PDF, JSON, and CSV output; its stable scripting interfaces include the command, detector names, configuration section, exit codes, and machine-readable JSON and CSV formats. The project states that it supports Python 3.11 through 3.14 and is licensed under the MIT License.

geiger is a read-only command-line scanner from Atomburst that inventories AI agents, harnesses, MCP servers, plugins, skills, hooks, browser extensions, desktop AI applications, and related IDE configurations on a machine. It reads known configuration files and directories, identifies each finding's origin and evidence path, and labels capabilities such as code execution, secret storage, broad filesystem access, broad web access, and network access. Credential-shaped values are reported by key name, file, and secret type without exposing value contents; the scanner performs no telemetry and writes only an explicitly requested report file. It can emit terminal, HTML, or versioned JSON reports, scan specified project or home directories, enforce a strict exit status for findings that can execute code or hold secrets, and compare JSON snapshots to identify newly appeared, removed, or escalated findings. It runs through npx with Node.js 18 or newer, has no runtime dependencies or account requirement, and is licensed under MIT. The project notes that it reads configuration rather than runtime behavior, covers known locations, and does not determine whether a package is malicious.