Intelligence guide

Fresh signals.Private by default.

“Intel” is repyy’s name for a dated, signed offline snapshot of sourced package and version advisories plus exact published file hashes. It supplements the built-in behavioral rules; it is not AI analysis.

OfflineEvery scan uses local dataSignedUpdates are verified before activationAuditableReports record the snapshot used

A signal starts review

A package name alone does not prove that the resolved artifact is malicious. Confirm the version, source, hash, and surrounding context.

Rules and intelligence work together

Built-in rulesFind suspicious behavior and context in source, manifests, automation, and metadata. Use repyy rules explain RULE-ID for rationale.

Intel snapshotAdds sourced package/version advisories and exact SHA-256 file indicators. Use repyy intel status to see its date and source.

Every release includes an embedded snapshot. A normal host scan uses a verified cached snapshot when available and falls back to the embedded copy if the cache is broken. Docker scans use the image’s embedded snapshot so they do not read the host cache.

Check before you scan

Status is offline. It reports the snapshot version, date, source, freshness, verification state, and indicator counts. Scans record the selected snapshot in their reports.

Show active snapshot

repyy intel status

Use the result in context

A stale snapshot does not make a clean scan meaningless, and a current snapshot does not make a match conclusive. Treat both as review inputs.

Update only when you choose to

Scans never contact the update service automatically. Run the explicit update command when you want to download a newer public snapshot from GitHub Releases.

Download and activate

repyy intel update

repyy verifies the Ed25519 signature and validates the snapshot before activating it atomically. An invalid or incomplete update leaves the existing verified snapshot in place. The update does not upload source, paths, findings, or file hashes.

Roll back a cached update

Rollback restores the previous verified cached snapshot when one exists. It cannot roll back the embedded snapshot or a cache with no previous version.

Restore previous cache

repyy intel rollback

Run repyy intel status afterward to confirm the active source and date.

Investigate an indicator

Use these commands to understand what is active and why a finding exists. Prefer JSON when preserving an audit record.

Explain a rule

repyy rules explain EXEC-001

Check bundled rules and intel

repyy rules check

List active indicators

repyy rules list --format json

For package findings, compare the resolved version and advisory source. An exact published file hash is stronger evidence, but still inspect the file’s role and context.

Need scan coverage details?

Detection families, exclusions, resource limits, and incomplete-result behavior are documented in the coverage guide.