PAGES
← all tools
◆ Software Supply Chain Security

ReversingLabs Spectra Assure

Spectra Assure Community 2026-09-24 commercial

Summary

ReversingLabs Spectra Assure is a commercial software supply chainsoftware supply chainThe dependencies, tools and processes used to build and deliver software. Compromising one part can affect the products or organizations that rely on it. analysis tool that unifies malware analysis, threat hunting, and deep binary intelligence. It requires a paid license and operates as a service. The tool is for application security practitioners concerned with binary analysis and software supply chain security. Its documentation positions it alongside other tools in the appsec category. Spectra Assure was launched in 2009 and has had 12 releases in the tracked window, with the last one deployed nine days ago.

How ReversingLabs Spectra Assure helps

Which third-party components in this build contain malware or hidden threats before it ships to production?

unpacks and classifies every compiled package, component, and dependency, flagging exposures against its binary intelligence corpus before the release reaches production

Does this vendor-supplied binary actually match what the vendor claims it is?

performs deep static analysis on the compiled artifact to classify its true contents rather than trusting file names or metadata

Which of my dependencies has a known reputation for being malicious or risky?

checks each component against the accumulated goodware and malware intelligence corpus and reports the verdict per file

What changed inside this package between the version we approved and the one we just pulled?

compares binary composition across versions of the same package and surfaces newly introduced components or behaviors

Can I get more detail on why a specific file was flagged?

returns the reasoning behind a scanner verdict, including which scanners matched and how many, so the flag can be traced back to its source

all 14 features, with the evidence for each →

Languages

Not documented

Features

14 capabilities

Built from ReversingLabs Spectra Assure's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

  • ReversingLabs Spectra Assure covers 1 of the 5 supply chain security capabilities we track.

What ReversingLabs Spectra Assure offers you

  • Built-in AI assistant1
  • CI/CD pipeline integration1
  • Command-line interface1
  • MCP server1
  • Plugin system1
  • Scripting language support1
All capabilities 14 capabilities
Network IOCs feed shipped A feed (TCF-0301) that reports network-based indicators of compromise, including domain records, consolidating malicious domain findings into a single record per domain. 2 releases · 3 other sources · first seen Sep 2024

release

  • Enables creation of GitHub-like badges with assessment of packages to embed in websites Spectra Assure Community 2024-12-12 · Dec 2024 · source · release history
  • Adds NuGet repository support with analysis reports for over 400k .NET packages Spectra Assure Community 2024-09-05 · Sep 2024 · source · release history

docs

  • Released Spectra Detect 6.4.1. See the Released File Inspection Engine 3.7.6. See the Released Spectra Analyze 9.12.0 See the Released File Inspection Engine 3.7.5. See the Updated TCF-0301 - Network IOCs Feed with information about domain records. seen Oct 2026 · source
  • Released File Inspection Engine 3.7.6. See the Released Spectra Analyze 9.12.0 See the Released File Inspection Engine 3.7.5. See the Updated TCF-0301 - Network IOCs Feed with information about domain records. docs update · Oct 2026 · source
  • Released Spectra Analyze 9.12.0 See the Released File Inspection Engine 3.7.5. See the Updated TCF-0301 - Network IOCs Feed with information about domain records. When a domain is classified as malicious, the feed now sends one record for the domain instead of separate records for each URL on it. seen Oct 2026 · source
AI assistant shipped An AI assistant available in both the legacy and new UI that supports context-aware chat and pre-determined prompts for dynamic analysis, threat reports, threat hunting, live incident triage, malware family summaries, and event timelines. 2 releases · 1 other source · first seen Oct 2025

Also counts toward: Built-in AI assistant

release

  • Enables built-in AI assistants in Spectra Resolve to triage issues, upgrade compromised packages, and apply verified patches Spectra Assure Community 2026-09-24 · Sep 2026 · source · release history
  • Revises UI for package browsing and adds programmatic API access to community OS data. Spectra Assure Community 2025-10-23 · Oct 2025 · source · release history

docs

  • v9.12 Added Spectra Assistant, an AI-assistant available in both the legacy and new UI that supports a context-aware chat, as well as several pre-determined prompts for initiating dynamic analysis, creating threat reports, threat hunting, live incident triage, creating malware family summaries, providing a timeline of… seen Oct 2026 · source
Integrated Development Environment Integration shipped Provides integration with IDEs and MCP clients via a standalone CLI tool, VS Code extension search expansion, and specialized plugins for automated scanning and report interpretation. 3 releases · first seen Mar 2026

Also counts toward: Command-line interface, MCP server, Plugin system

release

  • Enables searching for VS Code extensions by their Marketplace display name in addition to the extension identifier. Spectra Assure Community 2026-05-07 · May 2026 · source · release history
  • Releases new MCP server running as a Docker container to integrate Spectra Assure checks with Claude Code, Cursor, Gemini CLI, and other MCP clients Spectra Assure Community 2026-03-26 · Mar 2026 · source · release history
  • Adds rl-protect-skills plugin pack enabling Claude Code to install, configure, scan packages, and interpret reports via natural language Spectra Assure Community 2026-03-26 · Mar 2026 · source · release history
Vulnerability Analysis Enhancement shipped Enhances vulnerability reporting with severity filtering, tags, AI-generated code analysis summaries for malicious intent detection, and AI summaries for community report findings. 2 releases · first seen Jun 2026

release

  • Reports now include an AI-generated code analysis summary inspecting packages for malicious intent Spectra Assure Community 2026-07-02 · Jul 2026 · source · release history
  • The Vulnerabilities tab now supports filtering by severity and tags. Spectra Assure Community 2026-06-18 · Jun 2026 · source · release history
Undeclared Dependency Detection shipped Identifies components found through analysis that were not declared in the package manifest. 2 releases · first seen Feb 2025

release

  • Introduces rl-protect standalone CLI tool to parse PyPI, npm, and RubyGems manifest files and check declared dependencies Spectra Assure Community 2026-03-26 · Mar 2026 · source · release history
  • Adds Detect undeclared dependencies capability to identify components found through analysis that were not declared in the package manifest. Spectra Assure Community 2025-02-13 · Feb 2025 · source · release history
Malware Information Display shipped Displays threat name, classification, and description on the Malware Page within package details. 2 releases · first seen Nov 2025

release

  • Improves the Malware page to show detection location (dependency or component) and unique threat type details Spectra Assure Community 2026-02-12 · Feb 2026 · source · release history
  • Malware Page added to package details, showing threat name, classification, and description Spectra Assure Community 2025-11-05 · Nov 2025 · source · release history
Continuous Integration/Continuous Deployment Pipeline Integration shipped Enables integration with CI/CD tools including Artifactory for dependency blocking and JFrog Plugin support. 1 release · first seen Aug 2026

Also counts toward: CI/CD pipeline integration

release

  • Adds Artifactory plugin integration to automatically detect and block malicious or risky PyPI and npm dependencies before download Spectra Assure Community 2026-08-27 · Aug 2026 · source · release history
Package Coverage Expansion shipped Adds analysis support for Maven packages and expands existing coverage to include official PowerShell repositories. 1 release · first seen May 2026

release

  • Adds Maven package support to analysis reports Spectra Assure Community 2026-05-21 · May 2026 · source · release history
Supply Chain Visibility and Risk Indication shipped Improves supply chain visibility by supporting filtering for malicious or removed package versions, adding quarantined packages to the Pulse view, and introducing MCP Registry support for specific package types. 1 release · first seen Jan 2026

release

  • Enables filtering for versions of a package which are malicious or have been removed on the Versions page. Spectra Assure Community 2026-01-15 · Jan 2026 · source · release history
Community Authentication shipped Enables logging in to Spectra Assure Community via Google or GitHub credentials. 1 release · first seen Dec 2025

release

  • Enables logging in to Spectra Assure Community via Google or GitHub credentials Spectra Assure Community 2025-12-18 · Dec 2025 · source · release history
Package Compromise Risk Indication shipped Automatically marks new versions of packages to indicate potential compromise risk. 1 release · first seen Nov 2025

release

  • New versions of packages are now automatically marked to indicate potential compromise risk Spectra Assure Community 2025-11-05 · Nov 2025 · source · release history
PowerShell Repository Coverage shipped Covers the official PowerShell repository, enabling security analysis of scripts and modules. 1 release · first seen Sep 2025

Also counts toward: Scripting language support

release

  • Spectra Assure Community now covers the official PowerShell repository, enabling security analysis of scripts and modules. Spectra Assure Community 2025-09-25 · Sep 2025 · source · release history
Dependency Export shipped Exports package dependencies as CycloneDX files via the Dependencies page. 1 release · first seen Jan 2025

Shared capability: CycloneDX SBOM

release

  • Adds a button on the Dependencies page to export package dependencies as CycloneDX files Spectra Assure Community 2025-01-16 · Jan 2025 · source · release history
Docker Registry connector documented A connector that monitors Amazon Elastic Container Registry (ECR) repositories and automatically submits new container images to Spectra Detect for analysis. 1 other source

docs

  • v6.4.1 October 2026 Added the Docker Registry connector, which monitors Amazon Elastic Container Registry (ECR) repositories and submits new container images to Spectra Detect for analysis. seen Oct 2026 · source

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface

Five scores for ReversingLabs Spectra Assure, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail ReversingLabs Spectra Assure puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Commercials

pricing & packaging history · ReversingLabs vendor page

5 readings of ReversingLabs's pricing page since Apr 2026, with 1 change to what its plans include — each one dated, compared with the reading before it, and explained for someone buying the tool.

Pricing and packaging history is included with Researcher and Business. See how every vendor we track sells, and how that has changed over time, using data we don't publish anywhere else.

See plans →

Website history

reversinglabs.com, every change

ReversingLabs's home and pricing pages as they looked each month from September 2021 to September 2026: 16 renders, 5 changes of tagline or palette. Step through them, play them, or put any two months side by side.

Website history is included with Researcher and Business.

See plans →

Releases

Show

25 entries

  1. September 20262
  2. August 20262
  3. July 20263
  4. June 20261
  5. May 20262
  6. April 20262
  7. March 20261
  8. February 20262
  9. January 20262
  10. December 20251
  11. November 20251
  12. October 20251
  13. September 20251
  14. February 20251
  15. January 20251
  16. December 20241
  17. September 20241
    Show

    25 entries

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    browse all tools → score card for your toolchain →