TOOL

Name: mithril
Upstream: https://github.com/nmatt0/mithril
License: MIT
Language: C++20 (CMake)
Latest release: v0.2.1 (tagged; prebuilt binaries for linux-x86_64/arm64 and macos-arm64, plus a .deb)
Runtime deps: none beyond the C++ runtime (carries its own inflate). Optional,
not linked: trufflehog (live secret verification), curl and
unzip (to fetch/rebuild the offline CVE mirror).

WHAT IT DOES

mithril analyzes the contents of firmware and IoT software, a single file or an
unpacked rootfs, and reports four things as structured JSON:

• secrets: embedded credentials and key material (API tokens, cloud keys,
  JWTs, private keys, /etc/shadow hashes) with an offline confidence rating
• SBOM: components and versions from package databases (dpkg/opkg/apk/rpm),
  language manifests, ELF version strings, and the kernel banner, emitted as
  CycloneDX and SPDX
• CVEs: the SBOM joined against a local offline OSV + NVD/CPE mirror plus a
  curated kernel-CVE checklist, annotated with CISA KEV and EPSS
• licenses: the open-source licenses present

A scan makes no network calls; the CVE mirror is refreshed out of band.

WHY IT FITS KALI

It is the content-analysis half of a firmware workflow and pairs with moria
(the structural identify/unpack step): moria -e firmware.bin, then
mithril firmware.bin.extracted/. It gives Kali users fast, offline, evidence-
backed triage of credentials, known-vulnerable components, and license
obligations across a firmware tree during IoT/embedded and supply-chain work.

PACKAGING (READY)

A debian/ directory is maintained in the upstream repo, and the release
workflow builds a .deb that is attached to every GitHub release:

• debian/: https://github.com/nmatt0/mithril/tree/master/debian
• Prebuilt .deb (amd64 and arm64): on each release at
  https://github.com/nmatt0/mithril/releases
• Package name: mithril (clear in Debian; only node-mithril exists).
• debhelper-compat (= 13), cmake buildsystem. curl is a Recommends (CVE
  mirror fetch), unzip a Suggests; trufflehog is an optional runtime tool,
  never a dependency. The in-repo debian/ is generic/Debian-targeted
  (Maintainer: the author, distribution unstable), a ready starting point for
  the Kali house style. There is a debian/watch on the GitHub tags.
• Builds cleanly with dpkg-buildpackage; lintian is clean apart from the
  expected non-archive-build notes (suite name and no ITP bug to close).

Happy to maintain as Uploader and keep it current with upstream releases.