Detection engine
Four layers, cheapest first, stopping early where it can.
- Hash signatures — exact, zero false positives
- Pattern signatures — survive repacking
- YARA rules for families and tooling
- Heuristics for the unknown
Open source · MIT
Antivirus you can read line by line.
Four detection layers, real-time protection, a restorable quarantine and a patch checker. No cloud, no account, no telemetry.
Windows · macOS · Linux — Python 3.9+, zero required dependencies.
$ guardiantus quick --quarantine
[ G A ] Guardiantus AV v1.1.0
Scan quick · ~/Downloads, ~/Desktop, /tmp
THREAT Backdoor.Shell.ReverseTCP
~/Downloads/sys-health-check.sh
· [yara] Bash reverse shell via /dev/tcp
→ quarantined
Result 1 threat found
Files 8,412 scanned, 0 errors
Duration 14.2s
4Detection layers
0Required deps
9Package managers
150Tests passing
Everything included
One package, the whole job.
Scanning, blocking, containment and patching — plus the interfaces to drive them.
Real-time protection
Files are checked the moment they land.
- inotify / FSEvents / Win32 events
- Polling fallback with no dependencies
- Quarantine or report-only
- Pick exactly which folders
Scans
Quick, full, custom or a single file.
- Live progress, pause, resume, cancel
- Inside ZIP archives too
- Parallel, with a bounded worker pool
- Full history and event log
Quarantine vault
Threats are stored inert — and fully reversible.
- Restores byte-for-byte
- Cannot execute while parked
- Automatic retention limits
- Permanent delete overwrites first
Update manager
Outdated software is how most machines fall.
- apt, dnf, pacman, flatpak, snap
- Homebrew, winget, Chocolatey, pip
- Verified signature feed updates
- Installing stays your decision
Dashboard & CLI
Click it or script it — same engine underneath.
- Local web dashboard, light and dark
- Every command supports
--json - Exit codes built for cron and CI
- Cron-style scheduler
Play it
See what the engine catches.
Twenty files land in your queue. Allow the safe ones, quarantine the dangerous ones — then watch the engine show its work, layer by layer.
It runs the real detection logic in your browser. You can drop your own files in too; nothing is ever uploaded.
Incoming
Email attachment
Invoice_2026.pdf.exe
MZ ... PE VirtualAllocEx WriteProcessMemory CreateRemoteThread
How it works
Every file, four checks.
Layers run cheapest first. Findings are merged into one verdict you can explain.
Hash
One streaming pass gives MD5, SHA-1 and SHA-256. A dict lookup does the rest.
Patterns
Byte fragments that identify a whole family, not one build of it.
YARA
Rules for reverse shells, ransomware, stealers, injectors and miners.
Heuristics
Entropy, PE structure, obfuscation and naming tricks — scored, then thresholded.
Signature or heuristic? A signature hit names a specific family. A heuristic hit is an inference. Guardiantus tells you which one fired, so you always know how much to trust a verdict.
FAQ
Straight answers.
Is this a replacement for commercial antivirus?
Not for everyone. It has no kernel driver, no cloud reputation service, no threat-intelligence team and no behavioural sandboxing. What it does have is a real multi-layer engine you can audit end to end, and no telemetry. It ships with a small baseline signature set; for broad real-world coverage you point it at a signature feed.
What does it cost?
Nothing. MIT licensed, no paid tier, no account.
Does it phone home?
No. The only outbound requests are ones you configure: a signature feed URL, and whatever your package manager does when you click update.
Do I need to install anything else?
No. The engine, CLI and dashboard run on the Python standard library alone.
watchdog and yara-python are optional accelerators.
What if it flags something safe?
Quarantined files are stored intact and restore byte-for-byte in one click. You can also exclude paths and extensions, or lower the heuristic sensitivity.
Can I add my own signatures and rules?
Yes. Signature sets are plain JSON and YARA rules are ordinary
.yar files. Drop them in the data directory and reload.
Protect this machine in two minutes.
Install, run a quick scan, turn on real-time protection. That is the whole setup.