# Install scrutineer with Homebrew Security through scrutiny. Version 2026.07.28.1 via Homebrew; verified 2026-07-28. ## Install ```sh sudo av install brew:scrutineer ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install scrutineer ``` Evidence: local Homebrew formula metadata ## Package facts - **Package key:** brew:scrutineer - **Package manager:** Homebrew - **Version:** 2026.07.28.1 - **Source summary:** Security through scrutiny - **Homepage:** - **Repository:** - **Last updated:** 2026-07-28T22:27:02Z - **Generated:** 2026-08-03T19:37:03+00:00 ## Executables - scrutineer (alias) ## Install behavior - Bottle: not available ## Freshness - Page generated: 2026-08-03 - Package-manager version: 2026.07.28.1 ## Project history and usage Scrutineer is a local application-security workbench that scans open-source repositories with configurable agent skills, containerized language profiles, conventional analysis tools, and human-gated vulnerability-disclosure workflows. It combines a CLI-launched service with a local web interface for triage, verification, reporting, and release tracking. ### Project history Alpha-Omega introduced the public Scrutineer repository in April 2026 to make repeatable, evidence-focused open-source security review practical without overwhelming maintainers with untriaged reports. The project was packaged as a Go executable with embedded skills and runner profiles, and its first public GitHub release was v2026.07.14.1 in July 2026. ### Adoption history Scrutineer is an early-stage project. Its distribution includes precompiled Linux and macOS archives, source builds, container images, and a Homebrew formula; the official README also supports Docker, rootless Podman, and Apple's container runtime for isolated scans. ### How it is used An operator starts Scrutineer, opens its local web UI, and adds a repository URL, organization, SBOM, external finding report, or local source directory. A triage skill fans out into metadata, dependency, advisory, static-analysis, threat-modeling, and model-backed audit tasks, after which the operator verifies findings and controls disclosure through explicit workflow gates. ### Why package nerds care Scrutineer treats package metadata as security context: it discovers manifests, builds SBOMs, looks up registry versions and dependents, checks advisories, and can import dependencies for deeper scans. Its per-ecosystem runner profiles cover common package managers and native-extension cases, making it especially relevant to maintainers interested in the boundary between package graphs, reproducible tooling, and vulnerability disclosure. ### Timeline - 2026-04: Public repository development began. - 2026-07: First public GitHub release, v2026.07.14.1. ### Related projects - Semgrep, zizmor, git-pkgs, and brief are integrated as conventional analysis and repository-inspection tools. - Claude Code, Codex, and opencode are supported as pluggable agent backends. - Docker, Podman, and Apple's container CLI provide the supported isolated runner environments. ### Sources - - - - source_facts.package-manager.brew ## Security Notes No matching local secret-handling manifest was found for scrutineer. Nucleus package metadata is still published here so future coverage has a stable package URL. ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Configuration files - Unix: ./scrutineer.yaml ## Combined YAML source View the package source record on GitHub. [combined/scrutineer.yml](https://github.com/mxcl/pkgdb/blob/main/combined/scrutineer.yml) ## Sources - pkg.so package database - curated configuration and credential file locations - curated package history - pkgdb category and tag curation - cross-ecosystem install command graph