cleave answers one question — what can this program do? It extracts capabilities from binaries, source, documents, packages, and archives, matching them against the public Atomdrift traits rule set aligned broadly to MBC and MITRE ATT&CK. Apache-2.0, no telemetry.

• Supply-chain & malware triage. Run on a release, a suspicious sample, or a directory of dropped files. cleave diff old/ new/ highlights new capabilities, tampered headers, and provenance anomalies between versions.
• Feature extraction for ML/AI pipelines. Stable JSON schema, deterministic output, SHA256-keyed cache. Atomdrift Scan is the reference downstream classifier.

What cleave analyzes

• Binaries and bytecode — Mach-O, ELF, PE, WebAssembly, Android DEX, BEAM, MSI, CHM, PyInstaller, Java .class, Python .pyc, static libraries
• Source (24+ languages, tree-sitter) — Python, JS/TS, Go, Rust, C/C++, Java, Kotlin, C#, Swift, ObjC, Ruby, PHP, Perl, Lua, Shell, PowerShell, Groovy, Scala, Zig, Elixir, Clojure, Batch, VBScript
• Archives (recursive) — zip, tar (gz/bz2/xz/zst), 7z, rar, cab, jar/war, deb, rpm, pkg, apk, gem, crate, whl, nupkg, phar, vsix, xpi, crx, ipa, epub
• Documents & data — PDF structure, RTF, LNK shortcut metadata, Office (OLE2 + OOXML), OpenDocument, plist, HTML, XML, Markdown, PNG/JPEG, package manifests, GitHub Actions, systemd units, XDG .desktop

Open, inspectable rules

The rule set is a mix. The hand-written rules are precise for patterns humans understand well. The AI-derived ones come from a training corpus of about a million samples and cover the long tail across 20+ languages — territory no team is going to keep up with by hand.

The AI runs at build time, not at runtime. The cleave you ship is deterministic given the same input, traits, options, and analysis tools. No runtime AI model, GPU, or sample upload is required. Reports include an analysis timestamp, so serialized bytes differ between runs.

The first analysis downloads the compatible traits bundle if it is not installed. cleave also performs a best-effort release notice check at most once every 24 hours. Set CLEAVE_NO_UPDATE_CHECK=1 after setup to suppress that check.

Install

brew install atomdrift-project/tap/cleave             # macOS / Linux

From source (Rust 1.94+):

git clone https://github.com/atomdrift-project/cleave.git
cd cleave
make install

Usage

cleave suspect.bin                            # single sample
cleave /tmp/box-o-malware                     # recursive, unpacks archives
cleave diff v1.2.0/ v1.3.0/                   # release-to-release diff
cleave --format jsonl --min-crit suspicious   # streaming JSON for pipelines

Optional: rizin for disassembly, upx for runtime unpacking.