interplains/zero-breach-toolkit is a Python tool that checks computer and mobile phone data for traces of known mercenary spyware. The latest release shown on the repository is v0.1.14, and the provided records do not state what changed in this version. This description is based on the repository's README and release information. The tool describes itself as operating in read-only mode and making no network requests during inspection.
It can be used on Windows, macOS, and Linux, and its inspection targets also include Android phones and iPhone backups. It can therefore be seen as a tool that checks for known traces both on the device itself and in backups. The report shows not only what was found but also the strength of the evidence and the limits of what could not be confirmed. This is a design that does not present results merely as found or not found, but that also conveys how far each result can be interpreted. The repository is open source and states an Apache-2.0 license.
The scope this tool covers is traces of known mercenary spyware. The README warns that a report showing no traces is not proof that a device is safe. Results should therefore be interpreted as limited to what was confirmed in that inspection. The provided FACTS contains no figures showing detection rate or false positive rate, and no changelog for v0.1.14 was given. It is close to an auxiliary check that looks at confirmable traces, and it cannot be treated as a verdict that determines whether a device is safe.