/usr/bin/cleave

Deep static analysis tool for extracting features from binaries and source code

Usage: cleave [OPTIONS] [PATH]... [COMMAND]

Commands:
  analyze       Analyze files or directories
  regex-cost    Probe regex patterns for lazy-DFA explosion (reads stdin, one per line)
  iter-files    Enumerate recognized files as JSONL (for ingest pipelines)
  version       Show version, traits revision, and loaded resource counts
  validate      Validate all trait definitions for correctness and quality issues. Runs the full suite of validation checks (~60s+) and exits with a non-zero status code if any errors are found. Can also enable validation during scans via CLEAVE_VALIDATE=1
  diff          Compare two versions for supply-chain attack detection
  strings       Extract language-specific strings from a binary
  symbols       Extract symbols (imports, exports, functions) from a binary or source file
  imports       Extract imported foreign symbols
  exports       Extract exported symbols
  functions     Extract functions / methods defined in the file
  sections      Extract section information (name, address, size, entropy) from a binary
  metrics       Extract computed metrics from a binary or source file
  facts         Dump raw file facts for one or more files
  value         Dump or query the structural values tree
  test-rules    Debug rule evaluation - trace through how rules match or fail
  test-match    Test pattern matching against a file
  update-rules  Update trait rules from the upstream repository
  serve         Start HTTP API server for file analysis
  help          Print this message or the help of the given subcommand(s)

Arguments:
  [PATH]...
          Files or directories to analyze (when no subcommand is specified)

Options:
      --json
          Output as JSONL (machine-readable, streaming). Shorthand for --format jsonl

      --format <FORMAT>
          Output format: terminal (default), json (single object), or jsonl (streaming)

          Possible values:
          - json:     JSON output (single object), matching server mode response shape
          - jsonl:    JSONL output (newline-delimited JSON) for streaming
          - terminal: Human-readable terminal output
          - tiny:     Compact one-line-per-finding text output for small LLMs

  -o, --output <OUTPUT>
          Write output to file

  -v, --verbose
          Verbose logging

      --no-update-check
          Disable the periodic update notice (also: CLEAVE_NO_UPDATE_CHECK=1)

      --log-file <FILE>
          Write logs to file (in addition to stderr)

      --disable <COMPONENTS>
          Disable specific components (comma-separated: yara,radare2,upx,third-party)

          [default: ""]

      --enable-all
          Enable all components (overrides --disable default)

      --all-files
          Include all files in directory scans, even unknown types By default, only recognized code/binary files are analyzed

      --zip-password <PASSWORD>
          Additional passwords to try for encrypted ZIP/7z archives. Repeat the option to provide more than one password; built-in common sample passwords are always tried as well

      --platforms <PLATFORMS>
          Filter rules by target platform(s) (comma-separated, default: all) Examples: --platforms linux,macos or --platforms windows Valid values: all, linux, macos, windows, unix, android, ios, appliance, routeros, fortios, freebsd, openbsd, netbsd, aix, solaris

          [default: all]

      --extract-dir <DIR>
          Directory to extract all analyzed files for external tools or review. Files are written to `<dir>/<sha256>/<original-path>` preserving structure. When set, disables in-memory extraction (all files written to disk)

      --traits-dir <DIR>
          Custom traits directory (overrides CLEAVE_TRAITS_DIR env var and default "traits")

      --max-file-mem <MB>
          Maximum file size (in MB) to keep in memory during archive analysis. Files larger than this are written to temp files. Default: 100 MB

          [default: 100]

      --max-file-size <MB>
          Maximum file size (in MB) to scan during directory analysis. Files larger than this are skipped. Default: 20480 MB / 20 GB (0 = no limit). Sized to admit full OS images (ISO/UDF, DMG) from the os-image feed

          [default: 20480]

      --slow-rule-ms <MS>
          Warn when a single rule takes longer than this many milliseconds to evaluate. Rules >1000ms are always logged at debug level (visible via --verbose)

          [default: 4000]

      --min-crit <LEVEL>
          Minimum criticality level to include in output (filtered, component, baseline, notable, suspicious, hostile)

      --max-crit <LEVEL>
          Maximum criticality level to include in output (filtered, component, baseline, notable, suspicious, hostile)

      --min-file-crit <LEVEL>
          Minimum file criticality (based on highest trait) to include in output. Files whose highest-criticality trait is below this level are excluded entirely

      --max-file-crit <LEVEL>
          Maximum file criticality (based on highest trait) to include in output. Files whose highest-criticality trait is above this level are excluded entirely

  -h, --help
          Print help (see a summary with '-h')

  -V, --version
          Print version