Adversary
Sign In

Adversaries

Portable executable reviewers that analyze software artifacts and emit structured findings.

An adversary is closer to a focused Docker image or GitHub Action than a full application: small, versioned, and runnable in different environments. It declares what it needs (capabilities and optional isolation), not a large dependency stack.

Where they live

  • Free public catalog — official packages signed by Adversary Labs, identified by domain/name (not a free vs paid catalog). Browse at /adversaries; install with adversary pull.
  • Local projects — directories you pass as . or a path; trusted for host execution by path selection.
  • External registries — private or third-party OCI packages. Not official-signed unless you control signing keys; host execution is untrusted by default.
references
# Official free catalog (domain/name)
go/security
go/cli
ci/github-actions
security/secrets
web/react
infra/terraform

# Local project
./my-adversary

# External / private OCI
ghcr.io/acme/private-review:1.0.0

Lifecycle

  1. Author with the TypeScript SDK (adversary init).
  2. Validate and pack (adversary validate, adversary pack).
  3. Push to a registry (adversary push). Official catalog packages are additionally signed in release CI.
  4. Consumers pull and run (adversary pull, adversary run).

Execution trust and signatures: trust model, official signatures.