Know what the software on your machines is really shipping.
Achilles scans the applications installed on macOS, Windows and Linux and reports which ones carry outdated runtimes, weakened hardening or known vulnerabilities. Free, open source, and built on European vulnerability data.
Download the betaAchilles is a desktop application that inventories the software installed on a machine and tells you what it is made of: which framework each application is built on, which runtime versions it bundles, how it is signed and hardened, and whether any of that carries a published vulnerability. It reads applications as they are installed, without running them, and turns the result into evidence you can export.
An inventory of every installed application, and what is known about it.
Most vulnerability tooling looks at the code you write. Achilles looks at the software you run: the frameworks, runtimes and libraries that ship inside the applications on a machine, and the public advisories that apply to them.
Framework and runtime inventory
Identifies what each application is built with, such as Electron, Tauri, Flutter, Qt, Java, CEF, React Native or a native toolkit, and surfaces the exact versions of the runtimes it bundles, with a confidence rating for every finding.
Signing and hardening review
Reads code signatures, notarisation and hardening flags on macOS, Authenticode and PE mitigations on Windows, ELF hardening and sandbox permissions on Linux, and reports where protections are weaker than they could be.
Runtime vulnerability lookup
Checks every detected runtime version against ENISA's EU Vulnerability Database first, then OSV, NVD and GitHub advisories, with an age filter so long-lived components do not return decades of history.
Bundled dependency check
Reads the dependency manifest an application ships with and queries every package and version it finds in one batch, so third-party libraries are covered as well as the runtime itself.
Configuration review
A rule engine reads application code directly, without extracting or executing it, and flags configuration choices that weaken sandboxing, isolation or content security policy. Rule names follow established public tooling so findings stay portable.
System footprint
Lists what an application installs outside its own folder: browser messaging bridges, auto-start entries, background services, helpers and log directories. Changes that an installer makes quietly become visible.
Beta status. macOS is the most thoroughly tested platform; Windows and Linux discovery and detection are newer. Severity scoring is deliberately simple: Achilles is a risk indicator, not a verdict, and every finding links to the advisory it came from so you can judge it yourself.
From installed application to exportable evidence, in four steps.
- Step 01
Scan
Achilles discovers the graphical applications on the machine through the platform's own registry: Spotlight on macOS, Start Menu shortcuts on Windows, desktop entries, snaps, flatpaks and AppImages on Linux.
- Step 02
Inspect
Each application is read as installed. Nothing is launched, no sandbox is entered, and packaged formats are unpacked into a cache rather than executed.
- Step 03
Look up
Detected runtimes and dependencies are matched against the vulnerability feeds you enable. Results are cached for 24 hours, so repeat scans only query what is new.
- Step 04
Export
Every finding is written to a local journal and can be exported as self-describing JSON, per application or for the whole machine, ready for a report or a ticket.
European vulnerability data first.
Achilles leads with ENISA's EU Vulnerability Database because advisories from EU numbering authorities do not always reach other feeds in time, or at all. OSV and NVD are queried alongside it for the runtime-specific coverage they do best. All sources are configurable in the application's settings.
| Source | Default | Scope | Authentication |
|---|---|---|---|
| EUVD | Primary | ENISA's European Vulnerability Database, vendor and product search across every runtime | None |
| OSV | On | npm and crates.io ecosystems, including bundled dependencies | None |
| NVD | On | Chromium, Node.js, Flutter, Qt, Java, WebKit and other runtimes, matched by CPE | Optional API key |
| GHSA | Off by default | GitHub Global Security Advisories for npm, Rust and Go | Personal access token |
Three more things it can do for a compliance file.
Cryptography Bill of Materials
Inventories the cryptography an application actually uses, from its binaries and, optionally, its live TLS traffic, and exports a CycloneDX 1.6 CBOM graded for post-quantum readiness.
Rust dependency audit
For binaries built with cargo-auditable, extracts the embedded crate list and matches it against the RustSec advisory database.
Fleet mode
Runs as a background agent that re-inventories installed applications on a schedule and reports to a central collector, optionally using a trusted-host snapshot of the vulnerability data.
The Cyber Resilience Act asks what your software is made of.
Vulnerability-reporting duties under the CRA apply from September 2026 and full conformity from December 2027. Both rest on the same foundation: knowing which components an application ships and whether a published vulnerability affects them. Achilles answers that question for the machines you already have.
Due diligence on integrated components (Article 13)
Manufacturers must exercise due diligence when integrating third-party components. An inventory of what those components ship, and what is known about them, is the starting point.
Vulnerability handling (Annex I, Part II)
Knowing which runtime versions are in use, and whether a published advisory applies, is the first step of the handling process the CRA requires.
Bills of materials
Exportable inventories of dependencies and cryptography feed the SBOM and CBOM documentation regulators and customers increasingly ask for.
Evidence over assertion
Findings are written as timestamped JSON that can be attached to a technical file, a supplier questionnaire or an incident record.
- Local
Scans stay on the machine
Applications are read from disk. The only network traffic is the vulnerability lookup for the runtime names and versions found.
- Open
Source on GitHub
Every capability is its own Rust crate with a command-line example, so each check can be inspected and run on its own.
- Small
A few megabytes
Built with Tauri 2, the same toolkit CrabNebula maintains, so the auditor itself has a small footprint.
Try the beta on your own machine.
Free during the beta. Pick your platform; the scan starts as soon as the window opens.
All releases and changelog: web.crabnebula.cloud/crabnebula/achilles · Source: github.com/crabnebula-dev/achilles
Talk to us about fleet deployment