The catalog of MacCrab forensic plugins.
MacCrab's forensic side: collectors and analyzers that snapshot a Mac for incident response and baseline review — each designed to be Ed25519-signed, digest-pinned, and run under Apple's App Sandbox. Designed to install with one click in MacCrab, or one command in the terminal.
New here? The launch post has the full story: Introducing MacCrab Rave: the macOS forensic app store.
Forensic plugins.
Sandboxed collectors that snapshot a part of your Mac, plus analyzers that cross-reference the results. Every binary will be signed by its publisher and verified at install time.
What the catalog guarantees today.
Every entry is signed, digest-pinned, and you can verify it yourself without trusting this site. Client-side install-time enforcement ships with the MacCrab trust-floor release; here is exactly what holds now.
Ed25519 signed
The catalog index is signed by the rave key, and each plugin entry records its publisher's Ed25519 key. You can verify both today against the published public key — see how verification works.
Digest-pinned
Each published version pins immutable digests — artifact, manifest, signature, and a Mach-O-normalized canonical-tree hash, recorded at vetting time. Once a version's binary is cut, its pins are published so you can hash the download and compare it yourself before trusting it.
Signed revocation list
If a publisher key is compromised it is published to a signed revocation list you can fetch and verify. Automatic install-time refusal and quarantine of revoked plugins arrive with the MacCrab trust-floor release.
Sandboxed by design
Plugins are designed to run under Apple's App Sandbox via XPC, with no outbound network. The capability list is declared in each manifest and shown to you before you confirm install.