About

We're quietly building detection for the next generation of subtle attacks; think xzutils, but spiked with AI nightmare-fuel.

We've built a factory that continuously mints locally-runnable AI models based on the latest attacks and research articles: cleave extracts capabilities, azoth classifies them, and scan is our local scanning tool. Analysis runs on your hardware with no cloud scanner or API key; bundles and referenced artifacts can be fetched when you want current, supply-chain-aware results. Everything is Apache 2.0.

News

• 2026-08-13 A quiet first release of hood hood is a local enforcement layer that scans software before it reaches your package managers, installers, and curl | sh scripts. This is an early, experimental build we're putting out quietly to gather real usage.
• 2026-08-09 Introducing isomer — design partners wanted isomer is our differential supply-chain attack detector: an early, experimental build that judges the change between two versions instead of scoring a tree in isolation. We're looking for a few design partners to make sure we're building the right thing.

All news →

Projects

• scan stable
  ClamAV-style local scanner for AI-powered malware detection. Runs azoth and other open models against capabilities extracted by cleave — across binaries, scripts, and source.
• azoth stable
  Open ONNX model bundle for general malware detection. A routed ensemble over cleave-extracted capabilities across more than 100 recognized file and container types; runs on CPU.
• cleave stable
  Static analysis and capability extraction for source, binaries, bytecode, packages, archives, documents, and deployment configuration.
• stng stable
  Modern string extraction for binary analysis — all of the good stuff, none of the garbage. Useful for initial triage, C2 enumeration, credential extraction, and signature development.
• filefacts stable
  Rust library that reads a file and returns ML-ready facts for security pipelines — package identity, binary provenance, source AST features, strings, symbols, metrics, and structured errors in one cached parse.
• isomer experimental
  Supply-chain attack detection at a molecular level. A differential analyzer that judges whether the change between two versions is malicious — built to catch subtle attacks like xz-utils. In heavy development.
• hood experimental
  A local enforcement layer for software fetched by developers and AI agents — inspects public and private artifacts before they reach a package manager, installer, or curl | sh, adding zero-day detection without changing your workflow.