ScanBox is a Windows-first local security scanning CLI that orchestrates ClamAV, YARA, and capa, then emits a single JSON result for a file target or a directory summary for a directory target.
- Single-file scanning
- Directory scanning MVP via
scanbox scan <directory> - Engine orchestration across:
- ClamAV
- YARA
- capa
- Focused JSON on
stdout - Full JSON via
--report-out - Quarantine lifecycle commands:
scanbox quarantine listscanbox quarantine restore <scan_id>scanbox quarantine delete <scan_id> --yes
- Local environment verification via
scripts/verify_env.ps1 - Maintainer acceptance scripts for the current baselines
- GUI
- Drag-and-drop shell workflow
- Concurrent scanning
- Batch quarantine actions
- Archive expansion
- Cloud service or automatic upload
- Treating "no detection" as "safe"
.\.venv\Scripts\python.exe -m pip install -e .
powershell -ExecutionPolicy Bypass -File .\scripts\verify_env.ps1
.\.venv\Scripts\python.exe -m scanbox scan .\tests\fixtures\benign\hello.txtIf you are starting from an unpacked release zip rather than a repository checkout, start with QUICKSTART.md.
Fastest project walkthrough:
.\.venv\Scripts\python.exe -m scanbox scan .\tests\fixtures\benign\hello.txt
.\.venv\Scripts\python.exe -m scanbox scan .\tests\fixtures\eicar\eicar.com
.\.venv\Scripts\python.exe -m scanbox scan .\tests\fixtures\directory_mvp
.\.venv\Scripts\python.exe -m scanbox quarantine listFor the short showcase script and talking points, see docs/demo.md.
| Baseline | What it covers | Acceptance | Tag |
|---|---|---|---|
| v1 | Single-file scanning baseline | powershell -ExecutionPolicy Bypass -File .\scripts\acceptance_v1.ps1 |
scanbox-v1-freeze |
| v2.1 | Quarantine lifecycle baseline | powershell -ExecutionPolicy Bypass -File .\scripts\acceptance_v2_quarantine.ps1 |
scanbox-v2.1-quarantine |
| v2.2-A | Directory scanning baseline | powershell -ExecutionPolicy Bypass -File .\scripts\acceptance_v2_directory.ps1 |
scanbox-v2.2-directory-mvp |