# Install scrutineer with Homebrew Security through scrutiny. Version 2026.07.14.1 via Homebrew; verified 2026-07-14. ## Install ```sh sudo av install brew:scrutineer ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install scrutineer ``` Evidence: local Homebrew formula metadata ## Package facts - **Package key:** brew:scrutineer - **Package manager:** Homebrew - **Package manager page:** - **Version:** 2026.07.14.1 - **Source summary:** Security through scrutiny - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** MIT - **Source archive:** - **Last updated:** 2026-07-14T21:44:50Z - **Generated:** 2026-07-26T07:20:29+00:00 ## Executables - scrutineer (cli) - scrutineer (alias) ## Build dependencies - go ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-07-26 - Package-manager version: 2026.07.14.1 - Package-manager updated: 2026-07-14 - Local data: ok - Upstream repository: https://github.com/alpha-omega-security/scrutineer - info: No cached GitHub release or tag data was available. ## Project history and usage Scrutineer is a local application-security workbench that scans open-source repositories with configurable agent skills, containerized language profiles, conventional analysis tools, and human-gated vulnerability-disclosure workflows. It combines a CLI-launched service with a local web interface for triage, verification, reporting, and release tracking. ### Project history Alpha-Omega introduced the public Scrutineer repository in April 2026 to make repeatable, evidence-focused open-source security review practical without overwhelming maintainers with untriaged reports. The project was packaged as a Go executable with embedded skills and runner profiles, and its first public GitHub release was v2026.07.14.1 in July 2026. ### Adoption history Scrutineer is an early-stage project. Its distribution includes precompiled Linux and macOS archives, source builds, container images, and a Homebrew formula; the official README also supports Docker, rootless Podman, and Apple's container runtime for isolated scans. ### How it is used An operator starts Scrutineer, opens its local web UI, and adds a repository URL, organization, SBOM, external finding report, or local source directory. A triage skill fans out into metadata, dependency, advisory, static-analysis, threat-modeling, and model-backed audit tasks, after which the operator verifies findings and controls disclosure through explicit workflow gates. ### Why package nerds care Scrutineer treats package metadata as security context: it discovers manifests, builds SBOMs, looks up registry versions and dependents, checks advisories, and can import dependencies for deeper scans. Its per-ecosystem runner profiles cover common package managers and native-extension cases, making it especially relevant to maintainers interested in the boundary between package graphs, reproducible tooling, and vulnerability disclosure. ### Timeline - 2026-04: Public repository development began. - 2026-07: First public GitHub release, v2026.07.14.1. ### Related projects - Semgrep, zizmor, git-pkgs, and brief are integrated as conventional analysis and repository-inspection tools. - Claude Code, Codex, and opencode are supported as pluggable agent backends. - Docker, Podman, and Apple's container CLI provide the supported isolated runner environments. ### Sources - - - - source_facts.package-manager.brew ## Security Notes No matching local secret-handling manifest was found for scrutineer. Nucleus package metadata is still published here so future coverage has a stable package URL. ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Configuration files - Unix: ./scrutineer.yaml ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** scrutineer - **Version Scheme:** 0 - **Revision:** 0 - **Head Version:** HEAD - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** head, stable ## Related links - [Cloud CLI packages](https://www.automicvault.com/pkg/cloud-clis/) - Belongs to a cloud or infrastructure command family. - [Source-control packages](https://www.automicvault.com/pkg/source-control-tools/) - Belongs to a source-control command family. - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Language runtime packages](https://www.automicvault.com/pkg/language-runtime-packages/) - Matched language runtime, compiler, or interpreter metadata. - [go](https://www.automicvault.com/pkg/brew/go/) - Build dependency declared by Homebrew. - [cycode](https://www.automicvault.com/pkg/brew/cycode/) - Shares av.db curated category or tags: application-security, cli, security. - [clair](https://www.automicvault.com/pkg/brew/clair/) - Shares av.db curated category or tags: cli, containers, security, vulnerability-scanning. - [copa](https://www.automicvault.com/pkg/brew/copa/) - Shares av.db curated category or tags: cli, containers, security, vulnerability-scanning. - [cyclonedx-gomod](https://www.automicvault.com/pkg/brew/cyclonedx-gomod/) - Shares av.db curated category or tags: cli, go, sbom, security. - [govulncheck](https://www.automicvault.com/pkg/brew/govulncheck/) - Shares av.db curated category or tags: cli, go, security, vulnerability-scanning. - [retire](https://www.automicvault.com/pkg/brew/retire/) - Shares av.db curated category or tags: cli, dependency-analysis, sbom, security. - [syft](https://www.automicvault.com/pkg/brew/syft/) - Shares av.db curated category or tags: cli, containers, sbom, security. - [tern](https://www.automicvault.com/pkg/brew/tern/) - Shares av.db curated category or tags: cli, containers, sbom, security. - [retire](https://www.automicvault.com/pkg/npm/retire/) - Security-sensitive metadata or terminology overlaps. Shared terms: analysis, cli, sbom, scanning, security. - [cdxgen](https://www.automicvault.com/pkg/brew/cdxgen/) - Security-sensitive metadata or terminology overlaps. Shared terms: audit, cli, disclosure, sbom, security. ## Combined YAML source View the package source record on GitHub. [combined/scrutineer.yml](https://github.com/automic-vault/db/blob/main/combined/scrutineer.yml) ## Sources - Nucleus package database - package-page enrichment - curated configuration and credential file locations - curated package history - package version freshness - av.db category and tag curation - package relationship graph - cross-ecosystem install command graph