cleave answers one question: what can this program do? It unpacks the file, extracts structural facts, and matches them against the public Atomdrift traits rule set, aligned broadly to MBC and MITRE ATT&CK. Every finding points back to the strings, symbols, imports, or metadata that produced it. Apache-2.0, no telemetry.

• Triage. Run it on a release, a suspicious sample, or a directory of dropped files. cleave diff old/ new/ shows new capabilities, tampered headers, and provenance anomalies between versions.
• Features for other tools. Stable JSON schema, deterministic output, SHA-256-keyed cache, and a Rust library. Atomdrift Scan is the reference downstream classifier.

What cleave analyzes

• Binaries and bytecode — Mach-O, ELF, PE, WebAssembly, Android DEX, BEAM, MSI, CHM, PyInstaller, Java .class, Python .pyc, static libraries
• Source (24+ languages, tree-sitter) — Python, JS/TS, Go, Rust, C/C++, Java, Kotlin, C#, Swift, ObjC, Ruby, PHP, Perl, Lua, Shell, PowerShell, Groovy, Scala, Zig, Elixir, Clojure, Batch, VBScript
• Archives (recursive) — zip, tar (gz/bz2/xz/zst), 7z, rar, cab, jar/war, deb, rpm, pkg, apk, gem, crate, whl, nupkg, phar, vsix, xpi, crx, ipa, epub
• Documents & data — PDF structure, RTF, LNK shortcut metadata, Office (OLE2 + OOXML), OpenDocument, plist, HTML, XML, Markdown, PNG/JPEG, package manifests, GitHub Actions, systemd units, XDG .desktop

Open, inspectable rules

The rule set is a mix. Hand-written rules are precise for the patterns humans understand well. AI-derived rules come from a training corpus of about a million samples and cover the long tail across 20+ languages, which no team keeps up with by hand.

The AI runs at build time, not at runtime. Given the same bytes, traits bundle, options, and analysis tools, cleave's findings are deterministic. No runtime model, GPU, or upload. Reports carry a timestamp, so the serialized bytes differ between runs even when the findings do not.

The first run downloads the compatible traits bundle. cleave also checks for a new release at most once a day; CLEAVE_NO_UPDATE_CHECK=1 stops it.

Install

brew install atomdrift-project/tap/cleave             # macOS / Linux

Prebuilt binaries for macOS (signed and notarized), Linux, Windows, FreeBSD, OpenBSD, NetBSD, Solaris, and illumos are on the releases page.

From source (Rust 1.94+):

git clone https://github.com/atomdrift-project/cleave.git
cd cleave
make install

Usage

cleave suspect.bin                            # single sample
cleave /tmp/box-o-malware                     # recursive, unpacks archives
cleave diff v1.2.0/ v1.3.0/                   # release-to-release diff
cleave --format jsonl --min-crit suspicious   # streaming JSON for pipelines

Optional: rizin for disassembly, upx for unpacking, and upstream 7-Zip for disk images (p7zip cannot read APFS, so .dmg contents go unscanned).