1 plugin · catalog Ed25519-signed

The catalog of MacCrab forensic plugins.

Add forensic collection to MacCrab for incident response and baseline review. Published plugins have signed catalog entries and pinned download digests. First-party plugins run as trusted, unsandboxed processes with MacCrab's access. Review each plugin's access and output before installing.

Browse 1 plugin How verification works

Browsing and installing need no Rave account. Get MacCrab to use these plugins.

Plugins

Forensic plugins.

Explore the published collectors, their declared output, and their execution privileges. MacCrab verifies signatures and pinned digests during installation.

Mac Security Posture Pro Official

com.maccrab.forensics.posture-pro

Grades the Mac's hardening AND inventories its attack surface — persistence, login/background items, extensions, config profiles, privacy grants, quarantine events. Read-only, all-metadata.

Trust: Ed25519 · digest-pinned · first party
Declared output: metadata · may include sensitive paths and identities
Runs: Trusted process · unsandboxed · host access
Key: 07e39eb12c15b805…

v0.3.1 · Collector View plugin ▸

Trust model

What the catalog guarantees today.

Every entry is signed and digest-pinned. You can verify the published bytes against a trusted catalog key. Client-side enforcement is live: MacCrab verifies signatures at install and checks publisher trust and signed version revocations.

Ed25519 signed

The catalog index and plugin entries are signed by the Rave catalog key. Each entry records its publisher's Ed25519 key fingerprint. Verification establishes which trusted key signed the bytes; it does not establish collection completeness. See how verification works.

Digest-pinned

Each published version pins immutable digests — artifact, manifest, signature, and a Mach-O-normalized canonical-tree hash, recorded at vetting time. Once a version's binary is cut, its pins are published so you can hash the download and compare it yourself before trusting it.

Signed revocation list

The signed revocation list identifies affected plugin versions and explains each decision. MacCrab refuses affected installs, and periodic checks quarantine affected installed plugins. Third-party plugins are also quarantined when previously verified revocation data passes the client's freshness limit. The list's issue date and the client's last successful verification time are different facts.

Execution access

First-party plugins use a Developer-ID-validated, unsandboxed process. They inherit the host's privileges, including available Full Disk Access; this path does not enforce an outbound-network block. Community plugins have a separate sandbox and file-broker path that requires release qualification before wider availability.