Zero Breach Toolkit

interplains/Zero-Breach-ToolkitReviewed by AI

What it does

A free scanner that looks for traces of spyware that was already described in public research, such as Pegasus, Predator and Graphite. It reads browser records, startup settings, logs and files, and it can also read an Android collection or a local iPhone backup made on your computer. It is written for journalists, activists and anyone worried about being targeted. You install Python, download the folder from GitHub and start a menu from the terminal (on Windows there is a .cmd file to double-click). The check takes about 15 minutes.

How easy it is to install

C · install 1 or 2 tools · Windows

Windows C
macOS C
Linux C

On Windows, the easiest platform, you install Python with "Add python.exe to PATH" ticked, download the ZIP and double-click scan\run-scan.cmd, so there is no typing of commands. On Mac and Linux you type a command in the terminal, and on Mac you also have to give Terminal Full Disk Access or Safari's records are skipped.

Numbers on GitHub

Stars: 4,006on Oct 31, 2026
Downloads: 5,8032,011 this week
Growth: +4,006stars in 6 days

Stars over time

Facts

Runs on: Windows, macOS, Linux
You need to install: Python
To build from source: Python
Disk space: 100 MB–300 MB · estimate
Accounts or keys: None
Cost: Free · Apache-2.0 code; the indicator lists it downloads are published free by Amnesty International's Security Lab, the Citizen Lab, the MVT project and Echap.
License: Apache-2.0 (Permissive)
Can replace: iVerify
Last update: Nov 1, 2026

Risk signals (6)

AttentionDependencies with known vulnerabilities
Pinned dependencies with known vulnerabilities (OSV): cryptography: GHSA-g6cj-pr64-35w5, GHSA-jwv3-5hgf-82ww, GHSA-m2h6-j472-rp4c
automatic check
Attentionreports hold private personal data
README: "Full reports can contain usernames, profile names, file paths, browsing details, SMS senders and message excerpts; keep them private." Reports are saved to a findings folder on your computer, and an --evidence-bundle ZIP is explicitly "unencrypted".
AI review
Attentionphone check needs usb debugging
The Android steps tell you to turn on Developer options and USB debugging and to accept "Always allow" for the computer. The README says to turn USB debugging off again when you finish, but a phone left in that state is more exposed.
AI review
Infovery new repository with many stars
The repository was created on 2026-10-25 and already had 4,007 stars and 428 forks on 2026-11-01, with 16 releases in that first week. There is no long history to judge it by.
AI review
Infoanonymous publisher no signed binaries
README: "The project is anonymous, so do not take its word for anything" and "There is no signed Windows program, and none is planned while the project stays anonymous". Releases ship a single Python file with a published SHA-256 and GPG signature, not an installer.
AI review
Infooptional command downloads and runs another program
README, "Guided acquisition (experimental)": the optional --collect-android flag "downloads official AndroidQF v1.8.3, checks its pinned SHA-256, asks for the device owner's explicit consent and runs the collector". The README calls it "the only point at which the tool runs a program it did not ship".
AI review

Evidence is shown in its original language.

What Radar could not check

Whether the checks really run to the end on each version of Windows, macOS, Linux, Android and iOS.
Whether a result is correct: the project itself says a clean result is not proof the device is clean, and matches may be harmless (for example a news article that mentions a spyware address).
Whether the single Python file attached to each release really rebuilds to the published SHA-256.
How much disk and time a full check takes on a machine with many files, since it fingerprints files up to 120 MiB each.
Whether the pinned dependency versions with known vulnerabilities (cryptography) affect the parts of the tool that are used, beyond what the README claims.