"A doer of justice and arbiter" — Lycophron, Alexandra (3rd c. BCE)
Ichnaea — Titan daughter of Helios — possessed an oracle at Ichnae in Thessaly and stood among the chief goddesses at Apollo's birth on Delos. Her name springs from the Greek verb ichneuô (ἰχνεύω) — "to trace, to track, to follow the trail."
This tool follows her spirit across two decades of macOS and UNIX exploitation history, tracing the footprints of vulnerabilities that others miss and delivering justice to hidden weaknesses in your system's defenses.
- 14 modular security checks — Kernel/boot, memory, stack, hardware mitigations, side-channels, configurations, applications, network, privacy, filesystem, processes, and more
- 78 historical CVE analysis — Every major macOS/UNIX exploit from 2006 to 2026, heuristically assessed against your running system
- Dual architecture — Apple Silicon (M1-M4) and Intel support, with architecture-specific checks (PAC, KTRR, SMEP/SMAP)
- Three report formats — JSON (machine-readable), Markdown (human), HTML (dark-themed dashboard with security score)
- Local network scanning — Host discovery, port scanning, mDNS/Bonjour enumeration
- NIST mSCP aligned — References SP 800-219 Rev 2 compliance guidance
# From PyPI
pip install ichnaea
# From source
git clone https://github.com/cybaxx/ichnaea.git
cd ichnaea
pip install -e .Requires Python 3.9+ and macOS.
# Full scan (generates reports in ./ichnaea_report/)
ichnaea
# Custom output directory
ichnaea -o ~/security-reports
# Verbose logging
ichnaea -vRuns as python -m ichnaea or ./ichnaea.py.
| Section | What's covered |
|---|---|
| System Information | CPU, memory, XProtect, MRT, Gatekeeper version |
| Kernel & Boot | SIP, Secure Boot, SSV, KASLR, KTRR, AMFI, TCC |
| Memory Protections | ASLR, W^X, NX, PIE, W+X scanning |
| Stack Protections | Canaries, Safe Stack, guard pages, Shadow Stack (PAC) |
| Hardware Mitigations | PAC, BTI, MTE, SPTM, CoreTrust (Apple Silicon) / SMEP, SMAP, UMIP (Intel) |
| Side-Channel | Spectre, Meltdown, MDS/ZombieLoad, Pacman assessment |
| Historical Exploits | 78 CVEs (2006-2026) assessed against your macOS version + architecture |
| Configurations | Firewall, Gatekeeper, FileVault, Auto-update, SSH config, Bluetooth |
| Applications | Browser versions, Homebrew status, Java, Python, Node, Rosetta 2 |
| Network | Listening ports, DNS/DNSSEC, proxies, IPv6, third-party firewalls |
| Network Scan | Local subnet discovery, port scanning, mDNS/Bonjour enumeration |
| Privacy | TCC, Spotlight, Location Services, Siri, diagnostics |
| Filesystem | APFS encryption, SSV, Time Machine, firmware password (Intel) |
| Process Audit | Daemons, kernel extensions, login items, crontabs |
══ ICHNAEA (Ιχναίη) — Titan of Tracing, Oracle of Security ══
Daughter of Helios — Doer of Justice | v1.0.0
Host: mac.local | Apple Silicon (M-series ARM64) | macOS 26.6.1
══ Kernel & Boot Security ══
OK System Integrity Protection (SIP): ENABLED
OK KTRR: Present (Apple Silicon hardware enforcement)
══ Historical Exploit Analysis (2006-2026) ══
✅ CVE-2006-1458 [2006] QuickTime RTSP Buffer Overflow
➖ CVE-2017-5753 [2017] Spectre v1/v2 (not vulnerable on Apple Silicon)
✅ CVE-2026-23210 [2026] WebKit Speculative JIT RCE
SUMMARY
Historical exploits analyzed: 78
Mitigated: 74
Not applicable: 4
Potentially vulnerable: 0
Security score: 100/100
pip install -e ".[dev]"
# Run tests
pytest tests/ -v
# Lint
ruff check ichnaea/ tests/- Homeric Hymn to Delian Apollo (7th-4th c. BCE)
- Lycophron, Alexandra 128 ff (3rd c. BCE)
- Strabo, Geography 9.5.15 (1st c. BCE)
- NIST macOS Security Compliance Project (mSCP)
- Apple Internals knowledge base
- NIST SP 800-219 Rev 2, SP 800-53 Rev 5
MIT