PAGES
← all tools
◆ Endpoint Security (EDR/XDR)

clamui

v0.5.0 open-source

ClamAV Desktop application ( GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. )

Summary

How clamui helps

  • ClamAV configuration management 1 release · 1 other source · first seen Nov 2026
  • Network connection monitoring 1 release · 1 other source · first seen Nov 2026
  • Firewall auditing 1 release · first seen Nov 2026

all 8 features, with the evidence for each →

Features

8 capabilities across 3 capability groups

Built from clamui's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

  • clamui covers 2 of the 11 endpoint investigation and controls capabilities we track.
  • clamui covers 1 of the 8 investigation and response capabilities we track.

What clamui offers you

  • JSON data export1
File quarantine 1 feature Endpoint investigation and controls since 2026
Malware scanning and quarantine shipped Scans files using ClamAV and manages detected threats through quarantine, history, and export workflows. 1 release · first seen Nov 2026

Shared capability: File quarantine

Also counts toward: JSON data export

release

  • ClamUI now uses a headless Rust core with a Tauri 2/WebKitGTK and React desktop, replacing the Python/PyGObject runtime while retaining existing XDG JSON and SQLite data layouts, scanning, history, quarantine, profiles, exports, clipboard actions, tray controls, and file-manager integration. v0.5.0 · Nov 2026 · source · release history
Security baseline enforcement 1 feature Endpoint investigation and controls since 2026
ClamAV configuration management shipped Writes and applies native ClamAV configuration, with a recovery flow that exposes the exact configuration attempted per target path and separate copy actions for manual repair after failed writes. 1 release · 1 other source · first seen Nov 2026

Shared capability: Security baseline enforcement

release

  • A new Save & Apply recovery flow exposes a See Configuration panel showing the exact native ClamAV configuration attempted for each full target path, with separate copy actions for manual recovery after partial or failed writes. v0.5.0 · Nov 2026 · source · release history

example

  • After a failed configuration write, inspect exactly what ClamAV configuration ClamUI attempted before manually editing the file on disk. In ClamUI, open Preferences and trigger Save & Apply. If a write fails, click 'See Configuration' to view the exact native ClamAV configuration attempted for each full target path, then use the… v0.5.0 · Nov 2026 · source
Threat indicator matching 1 feature Investigation and response since 2026
VirusTotal IP lookup shipped Opens VirusTotal IP reports in the browser for accepted public IP addresses after explicit user confirmation, without transmitting port or process data. 1 release · first seen Nov 2026

Shared capability: Threat indicator matching

release

  • ClamUI now opens VirusTotal IP reports in the browser after explicit confirmation for accepted public IP addresses, without sending port or process information. v0.5.0 · Nov 2026 · source · release history
Other / not yet classified 5 features Features we have not matched to a capability yet. A suggested match is marked.
Network connection monitoring shipped Displays active TCP/UDP listeners and connections with filtering, copying, and process attribution that respects host permissions. 1 release · 1 other source · first seen Nov 2026

release

  • ClamUI now adds a Network view that shows current TCP/UDP listeners and connections with filtering, copying, and permission-aware process attribution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ v0.5.0 · Nov 2026 · source · release history

example

  • Review active TCP/UDP listeners and attribute them to processes to spot unexpected network exposure on a host. In ClamUI, open the Network view to see current TCP/UDP listeners and connections. Use the filter controls to narrow results, and copy rows of interest for reporting. v0.5.0 · Nov 2026 · source
Firewall auditing shipped suggested Inventories firewall rules across UFW, firewalld, nftables, and IPv4/IPv6 iptables in a read-only view. 1 release · first seen Nov 2026

Suggested capability: Security baseline assessment. This is our guess, not confirmed.

release

  • ClamUI's firewall audit now inventories UFW, firewalld, nftables, IPv4/IPv6 iptables, and supported management interfaces in a read-only, non-interactive view. v0.5.0 · Nov 2026 · source · release history
Localisation shipped Ships the interface in nine locales: German, English, Spanish, French, Hungarian, Italian, Norwegian Bokmål, Brazilian Portuguese, and Simplified Chinese. 1 release · first seen Nov 2026

release

  • The interface now supports nine active locales: German, English, Spanish, French, Hungarian, Italian, Norwegian Bokmål, Brazilian Portuguese, and Simplified Chinese. v0.5.0 · Nov 2026 · source · release history
Packaging and distribution shipped Provides native Debian packages, an x86_64 AppImage with zsync metadata, Flatpak bundles for x86_64 and aarch64, and helper-only Fedora RPM support for x86_64 and aarch64 with signed-package recovery. 1 release · first seen Nov 2026

release

  • Adds native Debian application and helper packages, an x86_64 AppImage with .zsync metadata, Flatpak bundles for x86_64 and aarch64, and helper-only Fedora RPM support for x86_64 and aarch64 with protected-preference recovery requiring the matching signed RPM and detached .rpm.asc asset for the host… v0.5.0 · Nov 2026 · source · release history
Privileged helper management shipped Distinguishes missing from untrusted helpers and, on supported hosts, can offer a Polkit-confirmed installation of a verified signed helper package. 1 release · first seen Nov 2026

release

  • ClamUI now distinguishes missing helpers from untrusted helpers and, on supported hosts, can offer a Polkit-confirmed installation of a verified matching signed helper package. v0.5.0 · Nov 2026 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for clamui, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail clamui puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

1 entry

  1. November 20261

    1 entry

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    browse all tools → score card for your toolchain →