About

We're quietly building detection for the next generation of subtle attacks; think xzutils, but spiked with AI nightmare-fuel.

We've built a factory that continuously mints locally-runnable AI models based on the latest attacks and research articles: cleave extracts capabilities, azoth classifies them, and scan is our local scanning tool. Analysis runs on your hardware with no cloud scanner or API key; bundles and referenced artifacts can be fetched when you want current, supply-chain-aware results. Everything is Apache 2.0.

Our mission and principles →

News

• 2026-08-14 cleave & Scan v2.7.1, isomer v0.4.0 CPU work, mostly. cleave is about 25% faster; Scan and isomer embed it, so they are too. Four file-type rules that never ran now run. isomer v0.4.0 adds three detectors that need no rules.
• 2026-08-13 isomer v0.3.0: learning from 30 years of attacks — plus cleave & Scan v2.7.0 This cycle was about shaping isomer into something useful: verdicts being calibrated against 30 years of real supply-chain attacks, cleanups no longer read as attacks, and the LLM can never raise the CI gate. cleave and Scan v2.7.0 carry the changes isomer needed. First release where all three ship prebuilt binaries.

All news →

Projects

• scan stable
  ClamAV-style local scanner for AI-powered malware detection. Runs azoth and other open models against capabilities extracted by cleave — across binaries, scripts, and source.
• azoth stable
  Open ONNX model bundle for general malware detection. A routed ensemble over cleave-extracted capabilities across more than 100 recognized file and container types; runs on CPU.
• cleave stable
  Static analysis and capability extraction for source, binaries, bytecode, packages, archives, documents, and deployment configuration.
• stng stable
  Modern string extraction for binary analysis — all of the good stuff, none of the garbage. Useful for initial triage, C2 enumeration, credential extraction, and signature development.
• filefacts stable
  Rust library that reads a file and returns ML-ready facts for security pipelines — package identity, binary provenance, source AST features, strings, symbols, metrics, and structured errors in one cached parse.
• isomer experimental
  Supply-chain attack detection at a molecular level. A differential analyzer that judges whether the change between two versions is malicious — built to catch subtle attacks like xz-utils. In heavy development.
• hood experimental
  A local enforcement layer for software fetched by developers and AI agents — inspects public and private artifacts before they reach a package manager, installer, or curl | sh, adding zero-day detection without changing your workflow.