Threats & Malware

Scan this Mac for malware and threats. Returns the actual detected items — each with its name, file path, category, and why it was flagged — split into real threats (real_threats) vs calm likely-legitimate background items (background_items, e.g. signed login items / browser extensions), plus counts and the overall level. Always list the specific real threats with their files/paths so the user can decide.

Run a forensic scan for leftover traces (metadata leaks, keychain artifacts, stealth headers) and return a 0-100 forensic score.

Move the real malware threats found by a scan into secure quarantine (calm likely-legitimate background items are left alone).

List the items currently held in Cyclone's malware quarantine — each with its name, original location, threat category/level, size, and when it was quarantined.

Restore one item from Cyclone's quarantine back to its original location (the undo of quarantine — e.g. for a false positive). Provide the item's name from list_quarantined_items. Only suggest this when the user is confident the item is safe.

Exclude a detected item from future malware scans so Cyclone stops flagging it (for items the user knows are safe, e.g. their own script). The item must appear in this conversation's most recent scan results — run run_malware_scan first.

List the items the user has excluded from malware scans (the scan ignore-list), each with its path and when it was excluded.

Remove an item from the malware-scan exclusion list so future scans flag it again (the undo of exclude_threat). Provide the name or path from list_threat_exclusions.

Report whether Cyclone's own malware-signature database is up to date: the installed signature version, when updates were last checked, and (when online) a live freshness check against the update server. Never reveals signature counts.

List the newest items in the Downloads folder with size, date, and whether macOS still marks them quarantined (unverified).

Report the versions of macOS's built-in malware defenses (XProtect, mrt, Gatekeeper data) — read locally, no network.

Report the state of Antivirus Check — Cyclone's watcher (on by default on new installs) that runs each new file through the same detection engines as a Deep Scan, for as long as Cyclone is running, including when only its menu-bar icon is showing. Returns whether it is enabled and actually watching, the active scope (Downloads and the folders directly inside it / internet arrivals anywhere / every new program anywhere apart from macOS's own temporary and cache folders), the files checked this session, how many arrived while Cyclone was closed, any live detections and any running-program advisories. It cannot read a program's memory.

Turn Antivirus Check on or off, and optionally set how much it watches. On means: for as long as Cyclone is running (the menu-bar icon counts; quitting stops it), every new file arriving in the chosen scope is checked with the same engines as a Deep Scan, and detections appear in the Antivirus/Malware Scanner panel with a Quarantine button. The scope is the Downloads folder and the folders directly inside it (the default), anything arriving from the internet anywhere on the Mac, or every new program anywhere apart from macOS's own temporary and cache folders — wider scopes add to the Downloads cover, never reduce it.

Check every program running right now: examines the file each one was launched from with the same engines as a Deep Scan, and flags a program running from a deleted file or with an extra library forced into it. Not a memory scan — macOS does not allow reading another program's memory — and advisories are presented as things to judge, since both signals have innocent causes.