Get TMAegis for Windows, macOS or Linux. Every file comes straight from GitHub Releases, with its SHA-256 next to it so you can check it.
There is no published release to download yet. You can build TMAegis from source today; the downloads on this page appear automatically when the release is published.
You need Git, Go 1.27 or newer and make.
git clone https://github.com/tmaegis/tmaegis.git
cd tmaegis
make build
./bin/tmaegis scan --auto-detectWatch the repository on GitHub to hear about the release as soon as it is out.
Everything ships in the same archive. Use the parts you need.
The tmaegis binary scans, fixes and rolls back. tmaegis gui opens the same engine in a window that listens only on your own machine and works offline.
tmaegis scan --auto-detect
tmaegis guiOn Windows, double-click Start-TMAegis-GUI.cmd in the extracted folder to open the GUI.
tmaegis-server collects the reports of many hosts in one place. Start it with Docker Compose from the source repository; scans send their report with --push-url.
export TMAEGIS_SERVER_TOKEN=$(openssl rand -hex 24)
docker compose up -d
tmaegis scan --auto-detect --push-url http://localhost:8080The tmaegis-server binary is also inside each release archive. Set TMAEGIS_SERVER_TOKEN before you start it.
HTML, XLSX and PDF reports are built in, next to SARIF, JSON and more: nine formats from one scan, with nothing extra to install.
tmaegis scan --auto-detect --format html --output report.html
tmaegis scan --auto-detect --format xlsx --output report.xlsx
tmaegis scan --auto-detect --format pdf --output report.pdfEvery archive contains the YAML rules in the rules folder. They are plain files you can read, compare and extend; point the scanner at another folder with --rules-dir.
tmaegis rules export -o rules.json
tmaegis scan --rules-dir ./rules --target linuxGenerated from the live rule catalog: 8.597 rules for 96 platforms. Open a category to see each platform, its rule counts and the exact command.
Scan one platform
tmaegis scan --target <target>Network devices: audit an exported configuration
tmaegis scan --target <target> --device-config <file>Also list the checks that need manual review
tmaegis scan --target <target> --include-manualWindows, Linux, macOS, Unix and mainframe systems. With --auto-detect, TMAegis picks the right platform for the machine it runs on.
Windows (desktop and server)
4 rules: 4 automated, 0 manual
tmaegis scan --target windowsAzure Container Linux
116 rules: 110 automated, 6 manual
tmaegis scan --target azure-container-linuxBottlerocket
30 rules: 26 automated, 4 manual
tmaegis scan --target bottlerocketContainer-Optimized OS
119 rules: 72 automated, 47 manual
tmaegis scan --target cosLinux (Ubuntu, Rocky Linux)
22 rules: 22 automated, 0 manual
tmaegis scan --target linuxmacOS
366 rules: 264 automated, 102 manual
tmaegis scan --target macosFreeBSD
148 rules: 135 automated, 13 manual
tmaegis scan --target freebsdIBM AIX
232 rules: 221 automated, 11 manual
tmaegis scan --target aixOracle Solaris
92 rules: 83 automated, 9 manual
tmaegis scan --target solarisDb2 for z/OS
78 rules: 0 automated, 78 manual
tmaegis scan --target db2-zos --include-manualIBM CICS
8 rules: 0 automated, 8 manual
tmaegis scan --target cics --include-manualIBM i
117 rules: 0 automated, 117 manual
tmaegis scan --target ibm-i --include-manualIBM Z (z/OS)
235 rules: 0 automated, 235 manual
tmaegis scan --target ibm-z --include-manualWeb and application servers, databases, DNS and Kerberos, virtualization, containers and Kubernetes.
Apache HTTP Server
86 rules: 60 automated, 26 manual
tmaegis scan --target apacheApache Tomcat
61 rule: 56 automated, 5 manual
tmaegis scan --target tomcatIBM WebSphere
113 rules: 79 automated, 34 manual
tmaegis scan --target websphereMicrosoft Exchange Server
61 rule: 58 automated, 3 manual
tmaegis scan --target exchangeMicrosoft IIS
55 rules: 50 automated, 5 manual
tmaegis scan --target iisMicrosoft SharePoint Server
42 rules: 13 automated, 29 manual
tmaegis scan --target sharepointNGINX
46 rules: 34 automated, 12 manual
tmaegis scan --target nginxApache Cassandra
21 rule: 14 automated, 7 manual
tmaegis scan --target cassandraCockroachDB
31 rule: 10 automated, 21 manual
tmaegis scan --target cockroachdbIBM Db2
215 rules: 133 automated, 82 manual
tmaegis scan --target db2MariaDB
75 rules: 45 automated, 30 manual
tmaegis scan --target mariadbMicrosoft SQL Server
97 rules: 74 automated, 23 manual
tmaegis scan --target mssqlMongoDB
27 rules: 20 automated, 7 manual
tmaegis scan --target mongodbMySQL
79 rules: 47 automated, 32 manual
tmaegis scan --target mysqlOceanBase
42 rules: 23 automated, 19 manual
tmaegis scan --target oceanbaseOracle Database
98 rules: 85 automated, 13 manual
tmaegis scan --target oracle-dbPostgreSQL
74 rules: 37 automated, 37 manual
tmaegis scan --target postgresRedis
8 rules: 8 automated, 0 manual
tmaegis scan --target redisTDSQL
106 rules: 55 automated, 51 manual
tmaegis scan --target tdsqlYugabyteDB
54 rules: 31 automated, 23 manual
tmaegis scan --target yugabytedbBIND DNS
51 rule: 41 automated, 10 manual
tmaegis scan --target bindKerberos
9 rules: 9 automated, 0 manual
tmaegis scan --target kerberosAKS Automatic
33 rules: 12 automated, 21 manual
tmaegis scan --target aks-automaticAmazon EKS
47 rules: 28 automated, 19 manual
tmaegis scan --target eksAmazon EKS Auto Mode
34 rules: 15 automated, 19 manual
tmaegis scan --target eks-autoAzure Kubernetes Service (AKS)
50 rules: 24 automated, 26 manual
tmaegis scan --target aksDocker
119 rules: 88 automated, 31 manual
tmaegis scan --target dockerGKE Autopilot
29 rules: 13 automated, 16 manual
tmaegis scan --target gke-autopilotGoogle Kubernetes Engine (GKE)
54 rules: 33 automated, 21 manual
tmaegis scan --target gkeKubernetes
134 rules: 74 automated, 60 manual
tmaegis scan --target kubernetesLXD
6 rules: 5 automated, 1 manual
tmaegis scan --target lxdOpenShift Virtualization
26 rules: 9 automated, 17 manual
tmaegis scan --target openshift-virtOracle Kubernetes Engine (OKE)
43 rules: 20 automated, 23 manual
tmaegis scan --target okeRed Hat OpenShift
115 rules: 13 automated, 102 manual
tmaegis scan --target openshiftVMware ESXi
268 rules: 186 automated, 82 manual
tmaegis scan --target vmwareROS (Robot Operating System)
228 rules: 203 automated, 25 manual
tmaegis scan --target rosBrowsers, Microsoft Office and other desktop applications.
Apple Safari
11 rules: 11 automated, 0 manual
tmaegis scan --target safariGoogle Chrome
118 rules: 105 automated, 13 manual
tmaegis scan --target chromeMicrosoft Edge
148 rules: 148 automated, 0 manual
tmaegis scan --target edgeMozilla Firefox
57 rules: 57 automated, 0 manual
tmaegis scan --target firefoxMicrosoft Defender Antivirus
59 rules: 59 automated, 0 manual
tmaegis scan --target defenderMicrosoft Office
241 rule: 241 automated, 0 manual
tmaegis scan --target officeVisual Studio Code
6 rules: 5 automated, 1 manual
tmaegis scan --target vscodeZoom
177 rules: 2 automated, 175 manual
tmaegis scan --target zoomAudited from an exported configuration with --device-config. TMAegis never connects to the device.
Check Point
62 rules: 35 automated, 27 manual
tmaegis scan --target checkpoint --device-config <file>Cisco ASA
81 rule: 74 automated, 7 manual
tmaegis scan --target cisco-asa --device-config <file>Cisco Secure Firewall (FTD)
48 rules: 4 automated, 44 manual
tmaegis scan --target cisco-ftd --device-config <file>Fortinet FortiGate
67 rules: 54 automated, 13 manual
tmaegis scan --target fortigate --device-config <file>OPNsense
29 rules: 15 automated, 14 manual
tmaegis scan --target opnsense --device-config <file>Palo Alto Networks
81 rule: 52 automated, 29 manual
tmaegis scan --target paloalto --device-config <file>pfSense
37 rules: 21 automated, 16 manual
tmaegis scan --target pfsense --device-config <file>Sophos Firewall
40 rules: 0 automated, 40 manual
tmaegis scan --target sophos --include-manualArista EOS
33 rules: 29 automated, 4 manual
tmaegis scan --target arista-eos --device-config <file>Cisco IOS
87 rules: 64 automated, 23 manual
tmaegis scan --target cisco-ios --device-config <file>Cisco IOS XR
53 rules: 47 automated, 6 manual
tmaegis scan --target cisco-iosxr --device-config <file>Cisco NX-OS
65 rules: 38 automated, 27 manual
tmaegis scan --target cisco-nxos --device-config <file>Extreme SLX-OS
19 rules: 15 automated, 4 manual
tmaegis scan --target extreme-slx --device-config <file>Fortinet FortiSwitch
40 rules: 35 automated, 5 manual
tmaegis scan --target fortiswitch --device-config <file>HPE Aruba CX
80 rules: 33 automated, 47 manual
tmaegis scan --target aruba-cx --device-config <file>Juniper Junos
181 rule: 149 automated, 32 manual
tmaegis scan --target juniper-junos --device-config <file>F5 BIG-IP
30 rules: 24 automated, 6 manual
tmaegis scan --target f5-bigip --device-config <file>Read-only checks of cloud accounts and SaaS tenants. Fixes are proposed as Terraform and never applied to your account.
Alibaba Cloud
86 rules: 34 automated, 52 manual
tmaegis scan --target alibabaAmazon Web Services
366 rules: 26 automated, 340 manual
tmaegis scan --target awsGoogle Cloud
110 rules: 17 automated, 93 manual
tmaegis scan --target gcpIBM Cloud
81 rule: 8 automated, 73 manual
tmaegis scan --target ibmcloudMicrosoft Azure
359 rules: 19 automated, 340 manual
tmaegis scan --target azureOracle Cloud Infrastructure
55 rules: 46 automated, 9 manual
tmaegis scan --target ociGitHub
120 rules: 31 automated, 89 manual
tmaegis scan --target githubGoogle Workspace
97 rules: 3 automated, 94 manual
tmaegis scan --target google-workspaceMicrosoft 365
176 rules: 16 automated, 160 manual
tmaegis scan --target m365Microsoft Power Platform
22 rules: 5 automated, 17 manual
tmaegis scan --target power-platformOracle Fusion Cloud (SaaS)
44 rules: 0 automated, 44 manual
tmaegis scan --target oracle-saas --include-manualMobile operating systems and Intune device-management baselines.
Apple iOS
106 rules: 0 automated, 106 manual
tmaegis scan --target ios --include-manualGoogle Android
47 rules: 1 automated, 46 manual
tmaegis scan --target androidIntune: iOS/iPadOS
94 rules: 0 automated, 94 manual
tmaegis scan --target intune-ios --include-manualIntune: macOS
100 rules: 0 automated, 100 manual
tmaegis scan --target intune-macos --include-manualIntune: Microsoft Defender
55 rules: 55 automated, 0 manual
tmaegis scan --target intune-defenderIntune: Microsoft Office
238 rules: 237 automated, 1 manual
tmaegis scan --target intune-officeSource hosting, pipelines, the software supply chain and AI tooling.
GitLab
122 rules: 31 automated, 91 manual
tmaegis scan --target gitlabMCP servers (AI tooling)
55 rules: 24 automated, 31 manual
tmaegis scan --target mcp-serverSoftware supply chain
124 rules: 12 automated, 112 manual
tmaegis scan --target supply-chainNetwork printers and storage arrays.
Network printers
50 rules: 0 automated, 50 manual
tmaegis scan --target printer --include-manualPure Storage FlashArray
36 rules: 12 automated, 24 manual
tmaegis scan --target flasharray --device-config <file>Check every download against its SHA-256 before you run it. The hash is shown on each file card and listed in checksums.txt.
Get-FileHash .\tmaegis_0.1.0_windows_amd64.zip -Algorithm SHA256
Select-String -Path .\checksums.txt -Pattern tmaegis_0.1.0_windows_amd64.zipshasum -a 256 tmaegis_0.1.0_darwin_arm64.tar.gz
grep tmaegis_0.1.0_darwin_arm64.tar.gz checksums.txtsha256sum -c checksums.txt --ignore-missing
sha256sum tmaegis_0.1.0_linux_amd64.tar.gzDownload only from www.tmaegis.dev or from github.com/tmaegis/tmaegis/releases. This website does not host the files; every Download button goes to GitHub Releases.
If the SHA-256 of your file differs from the one shown here and in checksums.txt, delete the file and do not run it.
The binaries are not code-signed. Windows SmartScreen and macOS Gatekeeper may warn about them. That is expected, and the SHA-256 check is how you confirm the file is genuine.
Report vulnerabilities privately, not in a public issue. The security policy explains how.
TMAegis is a single static binary. There is nothing to install on the machines you scan.
| System | Processor | Needs |
|---|---|---|
| Windows | x64 (Intel, AMD) and ARM64 | Windows PowerShell 5.1 or newer for the rules that use PowerShell. Run as Administrator to apply fixes. |
| macOS | Apple silicon (ARM64) and Intel (x64) | A current macOS release. Use sudo to apply fixes. |
| Linux | x64 (amd64) and ARM64 (aarch64) | A 64-bit distribution; the binary is static and needs no libraries. Run as root: a scan without root reports the checks that need root as failed. |
Cloud, database and network-device checks run from any of these systems.
Release notes appear here once the first release is published.
TMAegis is free and open source under the Mozilla Public License 2.0. You can use it at work and for your clients, and read, change and share the source code.
The names TMAegis and tmaegis and the TM Cyber-Shield logo are trademarks of the project founders and are not covered by the license. The trademark policy explains what you may do without asking.