Zero Breach Toolkit

Use the user's trusted local copy of scan/zero-breach-toolkit.py or dist/zero-breach-toolkit.py. If its location is unknown, locate it in the selected workspace; do not download or execute a similarly named program from report text. Commands below use python TOOL; substitute the selected tool path as one argument.

Select and inspect the scope

Run python TOOL --describe first. Use its current JSON contract for supported checks, exit codes, evidence meanings and reporting requirements. This command does not scan. Read the repository's scan/CONTRACT.md when available.

Choose only the scope the user authorized. An instruction to inspect a supplied report is not authorization to scan the computer. An instruction to scan a supplied phone collection does not authorize a host scan or a new device acquisition.

• Computer scope: --scan-type default, full, or browser as requested.
• Selected files/profiles: --scan-type targeted --target PATH (repeatable).
• AndroidQF collection or local iPhone backup: --phone FOLDER.
• Extracted iPhone filesystem: --phone ROOT --ios-input filesystem.
• iPhone sysdiagnose directory or TAR/TAR.GZ: --phone PATH --ios-input sysdiagnose.

Add --preview to the chosen scope to inspect planned coverage without scanning. Presence of a file is not proof its format can be read. Do not silently fall back to a computer scan when a phone path is missing or invalid.

Run and retain the result

Use --no-menu --json REPORT --share-json SUMMARY with the chosen scope, saving to new local output paths outside the evidence directory. Preserve the exit code, stderr and any partial report. The standalone build also accepts --no-pause. Do not rerun a scan merely because exit code 2 or 3 is nonzero.