Threats & Malware

Scan this Mac for malware and threats. Returns the actual detected items — each with its name, file path, category, and why it was flagged — split into real threats (real_threats) vs calm likely-legitimate background items (background_items, e.g. signed login items / browser extensions), plus counts and the overall level. Always list the specific real threats with their files/paths so the user can decide.

Run a forensic scan for leftover traces (metadata leaks, keychain artifacts, stealth headers) and return a 0-100 forensic score.

Move the real malware threats found by a scan into secure quarantine (calm likely-legitimate background items are left alone).

List the items currently held in Cyclone's malware quarantine — each with its name, original location, threat category/level, size, and when it was quarantined.

Restore one item from Cyclone's quarantine back to its original location (the undo of quarantine — e.g. for a false positive). Provide the item's name from list_quarantined_items. Only suggest this when the user is confident the item is safe.

Exclude a detected item from future malware scans so Cyclone stops flagging it (for items the user knows are safe, e.g. their own script). The item must appear in this conversation's most recent scan results — run run_malware_scan first.

List the items the user has excluded from malware scans (the scan ignore-list), each with its path and when it was excluded.

Remove an item from the malware-scan exclusion list so future scans flag it again (the undo of exclude_threat). Provide the name or path from list_threat_exclusions.

Report whether Cyclone's own malware-signature database is up to date: the installed signature version, when updates were last checked, and (when online) a live freshness check against the update server. Never reveals signature counts.

List the newest items in the Downloads folder with size, date, and whether macOS still marks them quarantined (unverified).

Report the versions of macOS's built-in malware defenses (XProtect, mrt, Gatekeeper data) — read locally, no network.