Quickstart

Install

git clone https://github.com/semicentric/neptune.git
cd neptune
cargo build --release
sudo cp target/release/neptune /usr/local/bin/

git clone https://github.com/semicentric/neptune.git
cd neptune/docker
docker compose up --build

Set up authentication

Neptune uses the Anthropic API for AI-powered analysis. You can authenticate via API key or OAuth:

export ANTHROPIC_API_KEY=sk-ant-...

neptune login

Analyze your first binary

Run the full pipeline against a firmware binary:

neptune analyze firmware.bin

This runs all seven stages sequentially:

1. Extraction — Parse the binary format, extract sections and metadata
2. Disassembly — Disassemble code sections, detect function boundaries
3. Quick scan — String matching, constant detection, compiler identification
4. Signature matching — Match function bytes against the signature database
5. AI analysis — Claude analyzes disassembly for library identification
6. SBOM generation — Produce CycloneDX, SPDX, VEX, HTML, and JSON reports
7. Vulnerability correlation — Check identified components against NVD and OSV

Output

Neptune generates reports in the current directory (or --output ./reports):

Quick scan (no AI)

If you don't need AI analysis, run a quick scan:

neptune scan firmware.bin

This skips AI analysis and signature matching, using only string and constant heuristics. Faster but lower confidence.

Analyze a full firmware image

If you have a firmware image (not just a single binary), Neptune can unpack it, scan every binary inside, and merge results into a unified SBOM:

neptune analyze-image firmware.img --format all --output ./reports

Malware triage

Run malware triage on a suspicious sample:

neptune analyze-malware sample.bin --output ./cases

This produces YARA matches, capa detections, ranked signals, and behavior hypotheses in a structured case directory.

Next steps