apple/security-pcc

This page introduces an external open-source repository. It is not an HDATF product.

What it does

Apple publishes selected Private Cloud Compute components so researchers can examine its security and privacy properties. This is not a ready-to-install chatbot or general inference-server product. The repository contains security-policy components and research tools and points readers to an accompanying official security guide. The inspected attestation-verification CLI accepts a report or attestation-bundle file and dispatches it to a format-specific validator. Its output paths include verification summaries and details or validated key and expiry information. Certificate and transparency-proof settings are present, but inspecting them neither reproduces all PCC nor independently proves its security. Research-tool environments and software terms must be checked before use; cloning does not activate a cloud service. A custom license restricts use to internal PCC verification on one Apple computer for a limited period and prohibits redistribution, unlike ordinary reusable open-source licensing. The guide body was inaccessible in this retrieval, so this description is limited to inspected repository documents and source.

License

Custom license Custom or non-standard license. Read the license file before any reuse.

More in this category

• interplains/Zero-Breach-Toolkit
  Zero Breach Toolkit is a defensive local checker that compares device evidence with published spyware indicators. It targets people examining their computers or phone backups for known traces. Inputs include browser records, selected operating-system artifacts, file fingerprints, AndroidQF collections and local iPhone evidence. Readable and JSON reports show matches, evidence strength and coverage gaps. Ordinary scans preserve source evidence, use temporary database copies and block Python socket calls. That guard is not operating-system network isolation, and indicator updates are a separate online action. Basic execution uses Python 3.8 or newer, while encrypted iPhone backups require an additional cryptography package and its supported environment. Optional Android acquisition requires owner consent and can change device state, unlike read-only scanning. No matches do not prove safety, and matches do not automatically establish infection. Full reports and unencrypted evidence ZIPs can contain sensitive records and need restricted sharing.
• anthropics/sandbox-runtime
  Anthropic Sandbox Runtime is a CLI and library that restricts file access and networking for arbitrary processes, including agents and local MCP servers. It accepts a command plus filesystem and network policies and executes the command within operating-system boundaries. macOS uses sandbox-exec, Linux uses bubblewrap, and HTTP and SOCKS5 proxies check permitted network destinations. The current README also describes alpha Windows support using a separate account, restricted tokens, file ACLs and WFP network filters. The package requires Node.js 22.12.0 or later, and restrictions apply only when commands are explicitly wrapped or the library is integrated. Linux requires bubblewrap, socat and ripgrep, while Windows requires a separate elevated setup step. Default reads are allowed, so automatic protection of secret files must not be assumed. Read-denied paths, write-allowed paths and allowed domains must be configured for the workload. This is an early research preview, and documented Windows gaps involving alternative tokens and service-mediated traffic prevent treating it as an absolute security boundary.
• Verlintas/NOIR
  NOIR is a desktop tool for inspecting privacy risks on Android devices that the operator owns or is authorized to audit. It reads installed applications, permissions and network address strings in APK files through adb, the Android device connection tool. It associates permission categories with possible destination domains and produces risk scores, JSON and Markdown reports, domain lists and remediation plans. Shared user permissions and application manifests provide additional evidence, while optional deeper inspection uses the separate local jadx decompiler. Its recommendations distinguish reversible application permission controls from actions requiring manual review and can produce rollback commands. The documented starting point is a portable package for Windows, macOS or Linux and a device that has authorized USB debugging, with adb prepared separately. Portable packages include a Java runtime, while source execution requires JDK 17 or later, and tool setup can download missing dependencies. These are static associations rather than proof of an actual transmission, and restricting permissions still requires checking whether legitimate application functions are affected.
• paradigmxyz/iron-proxy
  iron-proxy is an outbound traffic proxy for CI jobs, coding agents and containers that should not have unrestricted internet access. It accepts workload requests and a YAML policy, then forwards permitted traffic or rejects it while producing structured audit events. Its DNS and TLS interception route requests through ordered transforms, including destination allowlists and replacement of placeholder tokens with real credentials held by the proxy. The inspected allowlist implementation rejects unmatched requests unless an explicit warning-only mode is selected. Deployment requires the proxy process or container, configured destinations and secret sources, client trust in its CA, and actual routing through it. DNS configuration alone is not a containment boundary because a workload can connect directly, so separate network enforcement is needed. Optional MCP policy filters tools and arguments over Streamable HTTP, but its documented scope does not cover resources or prompts. Audit body capture and header annotations can expose plaintext, and TLS interception makes the proxy and CA sensitive infrastructure rather than an automatic guarantee against data leakage.
• openai/php2shell-checker
  PHP Version Checker helps website operators identify PHP versions that fall within the repository's php2shell vulnerability ranges. It accepts a website URL or a local PHP executable as input. The URL path reads Server and X-Powered-By response headers, while the local path reads the executable's version output. It compares the extracted version against an embedded table of vulnerable patch cutoffs for each listed branch. Results are OK, VULNERABLE, or UNKNOWN, with JSON output and exit codes available for automation. The repository also provides separate agent instructions for URL-only checks and checks with server access. Direct use requires Node.js, and checking the actual serving build requires access to the relevant server installation. It neither follows redirects nor inspects response bodies, and hidden headers, modified banners, vendor backports, and a different command-line PHP installation can make the result incomplete or misleading.

Only repositories in the ranked Trendshift lists are included, and the lists are used only to find candidates. We do not copy their ranks. Descriptions, licenses and star counts come from each GitHub repository. The notes are our own reading. We have not tested these projects, and a place on a trending list does not prove quality.