Getting started

Install

On macOS or Linux:

brew install atomdrift-project/tap/cleave

Or build with Rust 1.94 or newer:

git clone https://github.com/atomdrift-project/cleave.git
cd cleave
make install

Rizin is recommended for deeper executable analysis. UPX is optional and adds runtime unpacking for supported files.

First analysis

cleave --version
cleave suspect.bin

The first run downloads the compatible traits bundle if it is not already installed. The terminal report ranks capabilities from baseline through hostile and shows the evidence behind each finding.

Focus the result

cleave --min-crit suspicious suspect.bin
cleave --format json suspect.bin
cleave --format jsonl ./samples

Directories are recursive. Supported archives and packages are unpacked and their members are analyzed.

Compare two releases

cleave diff v1.2.0/ v1.3.0/

The diff covers capabilities, metrics, values, symbols, strings, and sections. Start with the new suspicious/hostile capabilities, then inspect the evidence and structural changes that introduced them.