← Safety

CanaryScanCanaryScan

PSA Intelligence

开源Open source 本地Local partial lifecycle: maintenance 核验Checked 2026-11-06

核验标记表示资料完整度，不是产品评分。下列未确认项可能影响选型；请按对应来源逐项确认。The confidence mark describes evidence completeness, not a product score. Unconfirmed items below may affect your choice; check them against the relevant sources.

未确认的信息Information not confirmed

官方正文当日未把「提示注入文本检测」列为检测通道，它与间接注入攻击面的关系只有本站的读法，官方未说明
支持的文件格式全集（文档索引只给出「多种格式」级口径，未逐项清点）
severity 分级（critical 至 info）的具体判据
遥测与网络隔离的正式条款（当日只到「离线」这一口径）
历史基线 / 跨次运行比对是否存在
与 agent 运行时的集成方式（MCP 或其他扩展）
大陆直连与备案状态（cn 块记为 unknown）

The official text does not list "prompt-injection text detection" as a channel; the link to the indirect-injection attack surface is this site's reading, not an official statement
The complete set of supported file formats (the documentation index only gives a "various formats" level statement)
The concrete criteria behind the severity levels (critical down to info)
Formal telemetry and network-isolation terms (only the "offline" wording was available today)
Whether historical baselines / cross-run comparison exist
Integration with agent runtimes (MCP or other extensions)
Mainland direct reachability and filing status (recorded as unknown in the cn block)

PSA Intelligence 的开源命令行体检器：在你（或你的 agent）真正打开外部交付的文档集之前，先用静态解析把里面的 canary、追踪器、远程信标和按收件人区分的指纹找出来。它不是模型 I/O 护栏，也不是提示注入分类器，而是「接触前的反跟踪筛查」。

适合与不适合When to use it, when not to

适合接手泄露件、法律披露、调查材料这类外部文档集时的第一道静态检查，也适合放进流水线做批量复检。不适合需要理解自然语言指令是否被篡改的场景，也不适合需要实时拦截模型输入输出的链路—— 官方正文（2026-11-06 抓取）把它的能力面描述为对文件结构、元数据、嵌入对象与近似重复指纹的分析。

中文生态China availability 国产 / 国内可直接用 / 备案状态 · 快照domestic / direct access / CAC filing · snapshot 2026-11-06

出品属地Origin: 国外出品foreign-made　PSA Intelligence（GitHub 组织资料标注所在地为新加坡），非国产产品。PSA Intelligence (the GitHub organisation profile lists Singapore as location); not a domestic product.
国内使用Direct access: 直连未核验direct unknown　当日只核验 GitHub / 文档站 / PyPI 在通用网络下的可达性，未做大陆直连实测。Only general-network reachability of GitHub / docs site / PyPI was checked today; no mainland direct-access test was run.
备案状态CAC filing: 备案未核验filing unknown：当日未检索网信办公示名单，无官方依据判定备案状态；该产品不面向大陆公众提供服务。The CAC public registry was not searched on the verification day, so filing status has no official basis; the product does not serve the mainland public.

备案信息以网信办《生成式人工智能服务已备案信息》公示名单为准（按批次滚动更新，本站只抄编号不解读）；「大陆可直连」是本站从大陆网络直连实测的结果，不是厂商承诺。GitHub 类站点当日实测有波动，口径写在依据里。Filing status is quoted from the CAC public registry (updated batch by batch; this site copies the number and does not interpret it). "Direct access" is this site's own reachability measurement from a mainland network, not a vendor promise. GitHub-hosted sites fluctuated on the measurement day — the note says so.

固定坐标系Fixed coordinate system

8 个维度dimensions, 与同分区其他对象逐项可比each comparable item by item against others in the same section.

模型与开放条件Model & openness: 当日抓到的 README 与文档索引都没有把「调用谁的模型」作为配置项：检测被描述为对文件原始结构、元数据、嵌入对象与近似重复指纹的静态解析。文档索引当日口径为离线运行、不涉及 LLM 与 API 密钥。是否在某个阶段引入过模型判定，官方正文未说明。
Neither the README nor the documentation index reached today treats "whose model" as a configuration item: detection is described as static analysis of raw file structure, metadata, embedded objects and near-duplicate fingerprints. The documentation index states, as of the verification day, offline operation with no LLM and no API key involved. Whether any stage ever consults a model is not stated officially.
运行位置Where it runs: 本机命令行工具，两种官方装法：pipx install canary-scan（README 要求自备 exiftool、qpdf、poppler-utils、 mupdf-tools、ripgrep、unzip、p7zip 等系统依赖）与容器 ghcr.io/psaintelligence/canary-scan:latest （官方推荐，理由是镜像已打齐系统工具）。PyPI 元数据当日要求 Python 3.10 及以上。
A local command-line tool with two documented installs: pipx install canary-scan (the README expects you to provide system tools such as exiftool, qpdf, poppler-utils, mupdf-tools, ripgrep, unzip and p7zip) and the container image ghcr.io/psaintelligence/canary-scan:latest, which the README recommends because the image bundles those system tools. PyPI metadata measured today requires Python 3.10 or newer.
本地文件Local files: 核心动作就是读你提供的文件集：官方 Docker 示例把数据源目录以只读方式挂载（-v /mnt/datasource:/data:ro），结果写入独立输出目录。README 明确「不以外来文件的原生查看器打开它」即可完成检测，即刻意避免触发文档里可能存在的远程引用。逐阶段产物写在 .canary-scan/。
Reading the file set you supply is the core action: the Docker example mounts the data source read-only (-v /mnt/datasource:/data:ro) and writes results to a separate output directory. The README states inspection happens without opening a file in its native viewer, deliberately avoiding remote references that documents may contain. Per-stage artefacts land in .canary-scan/.
关机后的任务Tasks after shutdown: 按次运行的批处理命令，不是常驻服务。官方未说明守护进程、任务队列或增量监控模式；要做周期性复检只能自己排班。
A batch command run per invocation, not a resident service. No daemon, task queue or incremental-watch mode is stated officially; periodic re-scans have to be scheduled by you.
工具与扩展Tools & extensions: 官方文档索引当日列出的命令面是 scan、stage、report、deps，另有 --guide 输出速查表；报告为 JSON（示例用 jq 过滤 severity=="critical"），可直接进脚本与流水线。七阶段管道为 inventory、metadata、remote-refs、embedded、stego、uniqueness、report，每阶段落一份 JSONL。 MCP 与其他扩展接入方式官方未说明。
The command surface listed by the documentation index for the day is scan, stage, report and deps, plus --guide for a cheat sheet. Reporting is JSON (the example filters severity=="critical" with jq), so it drops straight into scripts and pipelines. The seven-stage pipeline is inventory, metadata, remote-refs, embedded, stego, uniqueness and report, each writing one JSONL artefact. MCP or other extension points are not stated officially.
上下文与记忆Context & memory: 单次扫描自成一体，不存在会话记忆。跨文件的关联靠 uniqueness 阶段的近似重复指纹与阶段产物文件，官方未说明历史基线、跨次运行的比对库或结果留存策略。
Each scan is self-contained; there is no session memory. Cross-file linkage comes from the uniqueness stage's near-duplicate fingerprints and the stage artefacts. Historical baselines, cross-run comparison stores and retention policy are not stated officially.
权限与限制Permissions & limits: 许可 Apache-2.0，内置脚本另有 BSD 2-Clause（见 license 字段）。数据流向：当日抓到的 README 与文档索引未声明任何遥测、上报或外部服务调用，「离线」是文档索引给出的口径；网络隔离级别的正式条款官方未逐条说明。供应链侧官方口径是用 uv 的 exclude-newer 把第三方依赖钉到不超过 14 天的版本，内置脚本在构建期以 make vendor 固定并记录出处。
Licensed Apache-2.0, with BSD 2-Clause for bundled scripts (see the license field). On data flow: the README and documentation index captured today declare no telemetry, no reporting and no external service calls, with "offline" being the wording given by the documentation index; a formal network-isolation clause is not published. On the supply chain, the official text says third-party Python dependencies are pinned with uv's exclude-newer to releases no newer than 14 days, and the bundled scripts are fixed at build time via make vendor with provenance recorded.
适合什么任务Best for: 适合在接触外部交付的文档集（泄露件、法律披露、调查材料）之前先做一轮静态体检，看有没有能反向暴露「你在读它」的追踪像素、远程模板、信标、按收件人区分的指纹。不适合需要判定自然语言指令是否被篡改、或需要在运行时拦住模型输入输出的场景——官方正文把它定位为交付前的文档侧检测，不是模型 I/O 护栏。
Fits a static pre-flight over externally supplied document sets (leaks, legal disclosures, investigation material) to find anything that could reveal to the external party that the data source is being examined — tracking pixels, remote templates, beacons, per-recipient fingerprints. Does not fit judgement calls about tampered natural-language instructions, nor runtime interception of model input/output: the official text positions it as pre-contact document inspection, not a model-I/O guardrail.

头号误解Top misconception

把它当提示注入文本分类器：官方正文列的是 canary、追踪器、信标与指纹四类静态信号
以为 pipx 装完就能跑：解析依赖 apt 层的 exiftool、qpdf、poppler 等系统工具
以为扫描会打开文件确认效果：官方设计恰恰是不用原生查看器打开，以免触发远程引用

证据来源Evidence sources

最近核验记录Latest recorded check 2026-11-06，内容更新日content updated on 2026-11-06。单项复核范围见正文或来源说明，不代表所有字段在同一天重新核验。See the text or source notes for item-specific scope; this does not mean every field was rechecked on that date.

类型Type	名称Name	链接Link
changelog	CanaryScan · Releases（v0.2.0，2026-07-20；v0.1.1 至 v0.1.4 均在 2026-06-26）CanaryScan · Releases (v0.2.0, 2026-07-20; v0.1.1 to v0.1.4 all on 2026-06-26)	https://github.com/psaintelligence/canary-scan/releases
docs	CanaryScan · 官方文档站（命令面与七阶段管道）CanaryScan · official documentation site (command surface and seven-stage pipeline)	https://psaintelligence.github.io/canary-scan/
repo	CanaryScan · 仓库 README（Docker / pipx 用法与供应链口径）CanaryScan · repository README (Docker / pipx usage and supply-chain terms)	https://github.com/psaintelligence/canary-scan
docs	CanaryScan · 官方 LICENSE（Apache-2.0，内置脚本另有 BSD 2-Clause）CanaryScan · official LICENSE (Apache-2.0, bundled scripts additionally BSD 2-Clause)	https://github.com/psaintelligence/canary-scan/blob/main/LICENSE
docs	PyPI · canary-scan（0.2.0；requires_python 3.10 及以上）PyPI · canary-scan (0.2.0; requires_python 3.10 or newer)	https://pypi.org/project/canary-scan/

官方口径与未核到项Official record and unverified items

本站未做端到端实测：没有跑过 scan，没有核验过任何阶段的输出结构，也没有测过系统依赖缺失时的失败表现。本页只组织官方 README、官方文档站索引与 LICENSE / PyPI 元数据（均于 2026-11-06 抓取）。

This site has not run end-to-end tests: no scan was executed, no stage output structure was verified, and the failure behaviour with missing system dependencies was not observed. The page only organises the official README, the documentation-site index, the LICENSE and PyPI metadata, all fetched 2026-11-06.

官方命令面与管道Official command surface and pipeline

README 与文档站索引（2026-11-06）给出的用法要点：

容器：docker run --rm -v /mnt/datasource:/data:ro -v $(pwd)/canary-scan-out:/output ghcr.io/psaintelligence/canary-scan:latest scan /data -o /output
本机：pipx install canary-scan，再装 libimage-exiftool-perl qpdf poppler-utils mupdf-tools ripgrep unzip p7zip-full，然后 canary-scan scan /mnt/datasource
子命令：scan / stage / report / deps，--guide 输出速查表
七阶段：inventory → metadata → remote-refs → embedded → stego → uniqueness → report，每阶段写一份 JSONL 到 .canary-scan/
报告：canary-scan-out/canary-scan-report.json，示例用 jq 过滤 severity=="critical"

供应链口径（官方 README 原文要点）：第三方 Python 依赖用 uv 的 exclude-newer 钉到不超过 14 天的发布； Didier Stevens 的脚本在构建期用 make vendor 固定，commit SHA、版本与日期记在 src/canary_scan/bundled/VERSIONS.txt。

Usage points given by the README and docs index (2026-11-06):

Container: docker run --rm -v /mnt/datasource:/data:ro -v $(pwd)/canary-scan-out:/output ghcr.io/psaintelligence/canary-scan:latest scan /data -o /output
Host: pipx install canary-scan, then install libimage-exiftool-perl qpdf poppler-utils mupdf-tools ripgrep unzip p7zip-full, then canary-scan scan /mnt/datasource
Subcommands: scan / stage / report / deps; --guide prints a cheat sheet
Seven stages: inventory → metadata → remote-refs → embedded → stego → uniqueness → report, each writing one JSONL file into .canary-scan/
Report: canary-scan-out/canary-scan-report.json; the example filters severity=="critical" with jq

Supply-chain terms (key points of the official README): third-party Python dependencies are pinned to releases no newer than 14 days via uv's exclude-newer; the Didier Stevens scripts are fixed at build time with make vendor, with commit SHA, version and date recorded in src/canary_scan/bundled/VERSIONS.txt.

维护状态Maintenance status

仓库未归档；GitHub 显示最后推送与最新 release（v0.2.0）同为 2026-07-20，距本次核验已逾 90 天， release 历史集中在 2026-06-26 至 2026-07-20 两周内。据此 lifecycle 记 maintenance， confidence 上限 partial：节奏判断只是快照，不代表官方停维护的声明。

The repository is not archived. GitHub shows the last push and the newest release (v0.2.0) both on 2026-07-20, i.e. more than 90 days before this verification, and the whole release history sits inside the two weeks from 2026-06-26 to 2026-07-20. The entry therefore records lifecycle maintenance with confidence capped at partial: the cadence reading is a snapshot, not an official statement of discontinuation.