{ "$schema": "https://rave.maccrab.com/schemas/catalog.json", "schema_version": "1", "catalog_serial": 8, "generated_at": "2026-10-04T16:43:13Z", "count": 19, "plugins": { "com.maccrab.forensics.agent-exposure": { "id": "com.maccrab.forensics.agent-exposure", "display_name": "Agent Exposure", "short_description": "Review configured agent components, declared permissions and gaps in local source coverage.", "current_version": "0.1.0", "channel": "official", "runtime": "tierB", "trust_tier": "first-party", "signer_identity": "maccrab-rave:first-party", "signer_public_key_sha256": "07e39eb12c15b8052f5249134ea3337a0789ebc799d1c58d097aaa548a8aaae3", "kind": "collector", "privacy_class": "content", "requires_encrypted_scan": true, "status": "active", "metadata": { "category": "system", "tags": [ "collector", "agents", "mcp", "hooks", "configuration", "privacy" ], "min_maccrab_version": "1.22.3", "min_macos": "13.0" } }, "com.maccrab.forensics.browser-trust": { "id": "com.maccrab.forensics.browser-trust", "display_name": "Browser Trust", "short_description": "Review Chrome and Edge extension declarations, stored grants, native messaging links and snapshot changes, with explicit gaps.", "current_version": "0.1.0", "channel": "official", "runtime": "tierB", "trust_tier": "first-party", "signer_identity": "maccrab-rave:first-party", "signer_public_key_sha256": "07e39eb12c15b8052f5249134ea3337a0789ebc799d1c58d097aaa548a8aaae3", "kind": "collector", "privacy_class": "content", "requires_encrypted_scan": true, "status": "active", "metadata": { "category": "browser", "tags": [ "collector", "browser", "extensions", "permissions", "local-review" ], "min_maccrab_version": "1.22.3", "min_macos": "13.0" } }, "com.maccrab.forensics.build-witness": { "id": "com.maccrab.forensics.build-witness", "display_name": "Build Witness", "short_description": "Compare artifact bytes and file identities across selected build checkpoints; capture uses the separate companion.", "current_version": "0.1.0", "channel": "official", "runtime": "tierB", "trust_tier": "first-party", "signer_identity": "maccrab-rave:first-party", "signer_public_key_sha256": "07e39eb12c15b8052f5249134ea3337a0789ebc799d1c58d097aaa548a8aaae3", "kind": "collector", "privacy_class": "content", "requires_encrypted_scan": true, "status": "active", "metadata": { "category": "system", "tags": [ "build", "supply-chain", "checkpoint" ], "min_maccrab_version": "1.22.3", "min_macos": "13.0" } }, "com.maccrab.forensics.clickfix-review": { "id": "com.maccrab.forensics.clickfix-review", "display_name": "Suspicious Download Review", "short_description": "Review current Downloads and launchd evidence, exact path links, and visible collection gaps. Static review only; execution and compromise remain unknown.", "current_version": "0.1.0", "channel": "official", "runtime": "tierB", "trust_tier": "first-party", "signer_identity": "maccrab-rave:first-party", "signer_public_key_sha256": "07e39eb12c15b8052f5249134ea3337a0789ebc799d1c58d097aaa548a8aaae3", "kind": "collector", "privacy_class": "content", "requires_encrypted_scan": true, "status": "active", "metadata": { "category": "system", "tags": [ "collector", "downloads", "clickfix", "persistence", "local-review" ], "min_maccrab_version": "1.22.3", "min_macos": "13.0" } }, "com.maccrab.forensics.decoy": { "id": "com.maccrab.forensics.decoy", "display_name": "Decoy", "short_description": "Review selected marker registries and file-open exports; create and remove inert markers with the separate companion.", "current_version": "0.1.0", "channel": "official", "runtime": "tierB", "trust_tier": "first-party", "signer_identity": "maccrab-rave:first-party", "signer_public_key_sha256": "07e39eb12c15b8052f5249134ea3337a0789ebc799d1c58d097aaa548a8aaae3", "kind": "collector", "privacy_class": "content", "requires_encrypted_scan": true, "status": "active", "metadata": { "category": "system", "tags": [ "decoy", "incident-response", "file-events" ], "min_maccrab_version": "1.22.3", "min_macos": "13.0" } }, "com.maccrab.forensics.dependency-autopsy": { "id": "com.maccrab.forensics.dependency-autopsy", "display_name": "Dependency Autopsy", "short_description": "Map npm lock declarations to bounded installed-manifest, lifecycle and referenced-file evidence.", "current_version": "0.1.0", "channel": "official", "runtime": "tierB", "trust_tier": "first-party", "signer_identity": "maccrab-rave:first-party", "signer_public_key_sha256": "07e39eb12c15b8052f5249134ea3337a0789ebc799d1c58d097aaa548a8aaae3", "kind": "collector", "privacy_class": "content", "requires_encrypted_scan": true, "status": "active", "metadata": { "category": "system", "tags": [ "collector", "incident-response", "local", "static-analysis" ], "min_maccrab_version": "1.22.3", "min_macos": "13.0" } }, "com.maccrab.forensics.exit-check": { "id": "com.maccrab.forensics.exit-check", "display_name": "Exit Check", "short_description": "Review the exact archive or folder you are about to share.", "current_version": "0.1.0", "channel": "official", "runtime": "tierB", "trust_tier": "first-party", "signer_identity": "maccrab-rave:first-party", "signer_public_key_sha256": "07e39eb12c15b8052f5249134ea3337a0789ebc799d1c58d097aaa548a8aaae3", "kind": "collector", "privacy_class": "content", "requires_encrypted_scan": true, "status": "active", "metadata": { "category": "system", "tags": [ "collector", "incident-response", "local", "static-analysis" ], "min_maccrab_version": "1.22.3", "min_macos": "13.0" } }, "com.maccrab.forensics.first-hour": { "id": "com.maccrab.forensics.first-hour", "display_name": "First Hour", "short_description": "Review supported retained evidence, verify comparable follow-up observations and replay saved reviews with versioned rules.", "current_version": "0.2.0", "channel": "official", "runtime": "tierB", "trust_tier": "first-party", "signer_identity": "maccrab-rave:first-party", "signer_public_key_sha256": "07e39eb12c15b8052f5249134ea3337a0789ebc799d1c58d097aaa548a8aaae3", "kind": "collector", "privacy_class": "content", "requires_encrypted_scan": true, "status": "active", "metadata": { "category": "system", "tags": [ "collector", "incident-response", "local", "static-analysis" ], "min_maccrab_version": "1.22.3", "min_macos": "13.0" } }, "com.maccrab.forensics.identity-aftershock": { "id": "com.maccrab.forensics.identity-aftershock", "display_name": "Identity Aftershock", "short_description": "Review account-bound Microsoft Entra audit actions and separate saved delegated-grant snapshots after an incident.", "current_version": "0.1.0", "channel": "official", "runtime": "tierB", "trust_tier": "first-party", "signer_identity": "maccrab-rave:first-party", "signer_public_key_sha256": "07e39eb12c15b8052f5249134ea3337a0789ebc799d1c58d097aaa548a8aaae3", "kind": "collector", "privacy_class": "content", "requires_encrypted_scan": true, "status": "active", "metadata": { "category": "system", "tags": [ "entra", "identity", "incident-response" ], "min_maccrab_version": "1.22.3", "min_macos": "13.0" } }, "com.maccrab.forensics.last-good": { "id": "com.maccrab.forensics.last-good", "display_name": "Last Good", "short_description": "Compare exact artifact paths in two selected dated extracted directory snapshots.", "current_version": "0.1.0", "channel": "official", "runtime": "tierB", "trust_tier": "first-party", "signer_identity": "maccrab-rave:first-party", "signer_public_key_sha256": "07e39eb12c15b8052f5249134ea3337a0789ebc799d1c58d097aaa548a8aaae3", "kind": "collector", "privacy_class": "content", "requires_encrypted_scan": true, "status": "active", "metadata": { "category": "system", "tags": [ "collector", "incident-response", "local", "static-analysis" ], "min_maccrab_version": "1.22.3", "min_macos": "13.0" } }, "com.maccrab.forensics.localhost-lens": { "id": "com.maccrab.forensics.localhost-lens", "display_name": "Localhost Lens", "short_description": "Map visible TCP listeners to process labels and bind scope, with selected Ollama and Jupyter settings.", "current_version": "0.1.0", "channel": "official", "runtime": "tierB", "trust_tier": "first-party", "signer_identity": "maccrab-rave:first-party", "signer_public_key_sha256": "07e39eb12c15b8052f5249134ea3337a0789ebc799d1c58d097aaa548a8aaae3", "kind": "collector", "privacy_class": "content", "requires_encrypted_scan": true, "status": "active", "metadata": { "category": "system", "tags": [ "collector", "incident-response", "local", "static-analysis" ], "min_maccrab_version": "1.22.3", "min_macos": "13.0" } }, "com.maccrab.forensics.posture-pro": { "id": "com.maccrab.forensics.posture-pro", "display_name": "Mac Security Posture Pro", "short_description": "Grades the Mac's hardening AND inventories its attack surface \u2014 persistence, login/background items, extensions, config profiles, privacy grants, quarantine events. Read-only, all-metadata.", "current_version": "0.3.1", "channel": "official", "runtime": "tierB", "trust_tier": "first-party", "signer_identity": "maccrab-rave:first-party", "signer_public_key_sha256": "07e39eb12c15b8052f5249134ea3337a0789ebc799d1c58d097aaa548a8aaae3", "kind": "collector", "privacy_class": "metadata", "requires_encrypted_scan": false, "status": "active", "metadata": { "category": "system", "tags": [ "posture", "collector", "inventory", "hardening", "persistence", "extensions", "login-items" ], "min_maccrab_version": "1.19.0", "min_macos": "13.0" } }, "com.maccrab.forensics.remote-hands": { "id": "com.maccrab.forensics.remote-hands", "display_name": "Remote Hands", "short_description": "Review selected RustDesk, AnyDesk and Chrome Remote Desktop configuration and startup declarations.", "current_version": "0.1.0", "channel": "official", "runtime": "tierB", "trust_tier": "first-party", "signer_identity": "maccrab-rave:first-party", "signer_public_key_sha256": "07e39eb12c15b8052f5249134ea3337a0789ebc799d1c58d097aaa548a8aaae3", "kind": "collector", "privacy_class": "content", "requires_encrypted_scan": true, "status": "active", "metadata": { "category": "system", "tags": [ "collector", "incident-response", "local", "static-analysis" ], "min_maccrab_version": "1.22.3", "min_macos": "13.0" } }, "com.maccrab.forensics.repo-tripwire": { "id": "com.maccrab.forensics.repo-tripwire", "display_name": "Repo Tripwire", "short_description": "Expose declared project execution triggers and inspect supported shell behavior before trusting a repository.", "current_version": "0.1.1", "channel": "official", "runtime": "tierB", "trust_tier": "first-party", "signer_identity": "maccrab-rave:first-party", "signer_public_key_sha256": "07e39eb12c15b8052f5249134ea3337a0789ebc799d1c58d097aaa548a8aaae3", "kind": "collector", "privacy_class": "content", "requires_encrypted_scan": true, "status": "active", "metadata": { "category": "system", "tags": [ "collector", "incident-response", "local", "static-analysis" ], "min_maccrab_version": "1.22.3", "min_macos": "13.0" } }, "com.maccrab.forensics.script-trace": { "id": "com.maccrab.forensics.script-trace", "display_name": "Script Trace", "short_description": "Inspect selected shell scripts and trace supported literal Base64 pipelines into nested shell behavior without executing them.", "current_version": "0.1.1", "channel": "official", "runtime": "tierB", "trust_tier": "first-party", "signer_identity": "maccrab-rave:first-party", "signer_public_key_sha256": "07e39eb12c15b8052f5249134ea3337a0789ebc799d1c58d097aaa548a8aaae3", "kind": "collector", "privacy_class": "content", "requires_encrypted_scan": true, "status": "active", "metadata": { "category": "system", "tags": [ "collector", "incident-response", "local", "static-analysis" ], "min_maccrab_version": "1.22.3", "min_macos": "13.0" } }, "com.maccrab.forensics.secret-trail": { "id": "com.maccrab.forensics.secret-trail", "display_name": "Secret Trail", "short_description": "Find and review matching credential candidates across selected files, including JSON-escaped copies.", "current_version": "0.2.1", "channel": "official", "runtime": "tierB", "trust_tier": "first-party", "signer_identity": "maccrab-rave:first-party", "signer_public_key_sha256": "07e39eb12c15b8052f5249134ea3337a0789ebc799d1c58d097aaa548a8aaae3", "kind": "collector", "privacy_class": "content", "requires_encrypted_scan": true, "status": "active", "metadata": { "category": "system", "tags": [ "collector", "credentials", "incident-response", "local", "privacy" ], "min_maccrab_version": "1.22.3", "min_macos": "13.0" } }, "com.maccrab.forensics.side-door": { "id": "com.maccrab.forensics.side-door", "display_name": "Side Door", "short_description": "Inspect Mach-O dependency and rpath declarations and explicitly supplied library-load evidence without executing binaries.", "current_version": "0.1.0", "channel": "official", "runtime": "tierB", "trust_tier": "first-party", "signer_identity": "maccrab-rave:first-party", "signer_public_key_sha256": "07e39eb12c15b8052f5249134ea3337a0789ebc799d1c58d097aaa548a8aaae3", "kind": "collector", "privacy_class": "content", "requires_encrypted_scan": true, "status": "active", "metadata": { "category": "system", "tags": [ "collector", "incident-response", "local", "static-analysis" ], "min_maccrab_version": "1.22.3", "min_macos": "13.0" } }, "com.maccrab.forensics.skill-check": { "id": "com.maccrab.forensics.skill-check", "display_name": "Skill Check", "short_description": "Review selected agent instructions for credential access, upload, concealment and approval-bypass language.", "current_version": "0.1.0", "channel": "official", "runtime": "tierB", "trust_tier": "first-party", "signer_identity": "maccrab-rave:first-party", "signer_public_key_sha256": "07e39eb12c15b8052f5249134ea3337a0789ebc799d1c58d097aaa548a8aaae3", "kind": "collector", "privacy_class": "content", "requires_encrypted_scan": true, "status": "active", "metadata": { "category": "system", "tags": [ "collector", "incident-response", "local", "static-analysis" ], "min_maccrab_version": "1.22.3", "min_macos": "13.0" } }, "com.maccrab.forensics.trust-delta": { "id": "com.maccrab.forensics.trust-delta", "display_name": "Trust Delta", "short_description": "Compare two selected app bundles and explain changes in native-architecture signing metadata and embedded Mach-O components.", "current_version": "0.2.0", "channel": "official", "runtime": "tierB", "trust_tier": "first-party", "signer_identity": "maccrab-rave:first-party", "signer_public_key_sha256": "07e39eb12c15b8052f5249134ea3337a0789ebc799d1c58d097aaa548a8aaae3", "kind": "collector", "privacy_class": "content", "requires_encrypted_scan": true, "status": "active", "metadata": { "category": "system", "tags": [ "collector", "incident-response", "local", "static-analysis" ], "min_maccrab_version": "1.22.3", "min_macos": "13.0" } } } }