mithril

mithril analyzes the contents of firmware and IoT software, whether a single file or an unpacked rootfs. It looks for four things: embedded secrets and keys, a software bill of materials (SBOM), known CVEs affecting those components, and open-source licenses. It reports each finding with its evidence and a confidence, and it speaks clean JSON so scripts and LLM agents can drive it as easily as people can.

Good for:

• Surfacing embedded secrets and keys left behind in firmware.
• Building an SBOM of the components inside an image, then mapping known CVEs against them.
• Flagging open-source licenses across the contents of a rootfs.

Notes: A scan makes no network calls. Secrets, SBOM, and license analysis are fully offline; the CVE pass reads a local vulnerability mirror you refresh out of band. mithril is the semantic companion to moria, which identifies and unpacks firmware — moria maps the bytes, mithril reads the contents. Created by Matt Brown, who demos both tools here.