Think of Atomdrift Scan as ClamAV for AI-powered malware detection: a local scanner backed by open models that improve as newly observed malware behavior is captured, labeled, and folded back through cyclotron, Atomdrift's live training loop. (Scan was previously released as litmus.)

Hand it a path; it scans, classifies, and exits with a status code your CI can act on. Whatever cleave decomposes, Scan classifies — more than 100 source, binary, package, archive, document, and configuration formats. Files and model inference stay on your machine; no cloud scanner, API key, or GPU is required.

Today it scores capabilities with azoth, our weighted-ensemble model for context-free malware detection — now the default. Every verdict ships with a list of the capabilities that drove the score, computed on the live model rather than a post-hoc story. Severity is a false-positive budget, not a fixed scale: tell Scan how many false positives per 100M benign files you'll tolerate (-l, default L25) and that's the gate. Use -l 0 when a single false positive is unacceptable, higher when you'd rather not miss anything.

Capabilities

• File scanning — files, directories, and archives, classified against azoth by default
• Process scanning — running processes, via the on-disk image (memory-resident analysis is not yet implemented)
• Explainable verdicts — every score ships with a ranked list of the capabilities that drove it
• Optional LLM second opinion — --llm sends extracted evidence to an OpenAI-compatible endpoint and blends the response with the ML verdict
• Pluggable models — runs any model trained on cleave's capability schema; --model-dir swaps in a custom bundle

Network behavior: analysis is local, but the CLI downloads bundles on first use, refreshes stale bundles, and follows referenced packages and URLs by default. After setup, use SCAN_NO_UPDATE_CHECK=1 atomscan --no-update --fetch=none … for a fully offline run.

Install

Installer (macOS, Linux, BSD, Solaris, illumos, and Android):

curl -fsSL https://install.atomdrift.org/scan.sh | sh

On macOS and Linux, the installer delegates to Homebrew when it is available so Homebrew can manage upgrades, PATH, and dependencies. Pass --method binary to use the prebuilt release directly.

Windows PowerShell:

irm https://install.atomdrift.org/scan.ps1 | iex

See all supported platforms, requirements, and release downloads on the Atomdrift Scan install page.

From source:

git clone --depth 1 https://github.com/atomdrift-project/scan.git
cd scan
make install

Usage

$ atomscan <path>
$ atomscan -f json <path>    # machine-readable output

The first scan downloads the open model, rule, and bloom-filter bundles. Run atomscan version to see the exact inventory installed on your machine.

For more thorough results, install Rizin (binary reverse-engineering) and UPX (unpacker).