Our take
Inactiveno commits in over a year- Activity
- 19
- Community
- 4
- Issues
- 21
- Pull requests
- 20
-1 stars in the last 30 days
- Fewer contributors than 91% of the projects we track
Citadel brings several useful static-analysis views into one self-hosted interface, but its inactive status and reliance on a single contributor make it a cautious choice for ongoing operational use.
Good fit if
- You are a malware researcher or red-team analyst who needs PE-focused static analysis and can operate the service yourself.
- You can provide MongoDB and, for the .NET agent, a Windows VM.
- You can review and maintain the code if needed, given that most project work comes from one contributor and there have been no recent commits or releases.
Look elsewhere if
- You need a project with recent maintenance or a release track to support production adoption.
- You need a documented license before evaluating or modifying the code. No license is specified in the supplied repository metadata.
- Your workflow requires analysis beyond the PE, capability, and similarity features described by the project.
All health signals
| Last commit | 2025-10-09 (1 year ago) |
|---|---|
| Commits, last 90 days | 0 |
| Releases, last 12 months | 0 |
| Contributors | 1 |
| Issues closed, last 90 days | 0 |
| Pull requests merged, last 90 days | 0 |
| Project age | 21 months |
Checked on 2026-10-11 with the GitHub API.
Project history
Daily GitHub snapshots since Oct 7, 2026. History covers stars and forks; health signals are not tracked historically.
Stars
124Forks
12Change since Nov 13, 2026: 0 stars·0 forks
Overview
Citadel is a self-hosted static-analysis framework for Windows PE files. It helps malware researchers and red teams investigate why a payload may be detected by combining binary parsing, capability identification, and sample-similarity analysis in a web interface.
Analysis runs through an HTTP API and worker rather than requiring analysts to copy samples into a VM for each inspection. The project is aimed at research and defensive analysis, not at replacing a full malware-analysis lab.
Key Features
- Parses PE files using multiple parsers.
- Maps detected capabilities to MITRE ATT&CK and the Malware Behavior Catalog.
- Uses TLSH fuzzy hashes to compare and cluster similar samples.
- Provides a web dashboard for uploaded samples and analysis results.
- Exposes remote analysis over HTTP, avoiding manual file transfer to analysis VMs.
- Includes views for CAPA results, evasion indicators, and technical details.
Use Cases
- Malware researchers can review PE structure and behavior indicators while triaging a sample.
- Red teams can examine why a Windows implant is being detected by static security tools.
- Analysts can compare related payloads and cluster samples using fuzzy-hash similarity.
- Security teams can use capability mappings to organize findings against ATT&CK or the Malware Behavior Catalog.
What you need
Detected in the repository
- Python >=3.10 (from pyproject.toml)
Getting Started
The repository's install script sets up the listed dependencies and Citadel:
bash install.sh
Then start the frontend and worker in separate panes:
uv run frontend/app.py
uv run worker.py
See the README for setup details and the repository for the current code.
License in Plain Words
No standard license was detected. Without a license, the default copyright rules apply: you may read the code, but not reuse it. Check the repository or ask the authors.
Alternatives
- malwoverview: Malwoverview supports broader malware and indicator triage through CLI, REPL, or TUI workflows, rather than focusing on PE analysis in a web dashboard.
| Project | Language | License | Stars | Status |
|---|---|---|---|---|
| citadel | HTML | – | 124 | Inactive |
| malwoverview | Python | GPL-3.0 | 4.1k | Active |
Considerations
The project is marked inactive, with no commits in over a year and no releases in the past year. It has one contributor, so maintenance and continuity depend heavily on that person. The README lists MongoDB and a Windows VM for the .NET agent among the prerequisites; the install script also installs Radare2 and a TLSH database. No CI or tests are reported in the supplied project facts. The repository metadata does not specify a license, so check licensing before use, modification, or redistribution.
Found this useful?
Share it with someone who would like citadel.