Available on macOS, Linux and Windows
Luna
The antivirus that adapts. AI detection, seven layers, multi-OS.
Die App
Seven detection layers. One dome. One AI chat. One real sandbox.
Static signatures, ClamAV, behavioural monitoring, ML anomalies, Claude verdict, threat intelligence, Security Dome, embedded Claude chat, real VM sandbox (Lima / Docker), immutable audit log and self-healing — orchestrated by a lightweight daemon with CLI and PyQt6 GUI on macOS, Linux and Windows.
A look inside the app
A clear console, built to act fast
Eight views to operate Luna day to day — from engine status to the embedded Claude chat and Security Dome.
01 · Dashboard
Your whole protection state, at a glance
Engine status, signature hashes, 24-hour detections, quarantine, recent events and ML baseline — your machine's health read in under five seconds.
02 · On-demand scan
Deep analysis, with optional Claude verdict
Pick a folder, enable Claude analysis for ambiguous cases, hit scan. YARA, hashes, ClamAV and AI work together — detailed results, file by file.
03 · Quarantine
Safe isolation, controlled restore
Any suspect file is encrypted and held in quarantine out of reach. Inspect, restore or destroy — every action is tracked and reversible.
04 · Events & detections
Full history, filterable, exportable
Real-time log of every detection: matched signature, score, action taken, source. Filter by severity, engine or time range — everything is kept, nothing is lost.
05 · Response & AI
Claude writes your YARA rules
Describe a threat in plain language: Claude proposes a YARA rule ready to paste. Snapshots, webhooks and automatic rules turn detection into immediate response.
06 · Settings
Clear configuration, saved in YAML
AI analysis, behavioral monitoring, updates, VirusTotal, webhooks, hardening of Luna itself — every setting is documented and persisted in config.yaml.
07 · Claude chat
Talk to Claude with system context injected
A dedicated conversation page. Ask why a process looks suspicious, get an alert explained or request a YARA rule — Luna automatically injects your system context and recent history.
08 · Security Dome
Score, lockdown, honeypots and hunting in one place
The unified dome view: A→F security score, lockdown mode in one toggle, deployed honeypots with trigger counter, CVE scanner and threat-hunting queries — all in a single console.
Signatures + ClamAV
YARA + known hashes (MalwareBazaar) + optional ClamAV (+8M official signatures). Hourly automatic updates.
Alles-in-einem
What Luna does for your machine
Real-time monitoring
Behavioural detection across processes, network and filesystem. Instant alert on suspicious activity.
ML anomaly
Isolation Forest trained on a 7-day baseline. Catches what falls outside your normal usage — no rules to write.
Claude verdict & agent
Claude returns a verdict + plain explanation for ambiguous cases. An autonomous agent investigates your critical alerts on its own.
Embedded Claude chat
A dedicated chat page to ask Claude security questions straight from Luna: "is this process suspicious?", "explain this alert", "generate a YARA rule for X". System context is injected with every question.
Real VM sandbox
Detonate a suspect file inside a real disposable VM via Lima (macOS) or Docker (Linux / Windows). Captures file writes, network connections, child processes — with no risk to your machine.
Live threat intel
Public feeds (URLhaus, abuse.ch, Neo23x0) refreshed every 6 h. Network IOCs, URLs and hashes in real time.
Passive network analyzer
Spots periodic beaconing, DGA-style domain names, exfiltration spikes and DoH-tunnel bypasses without intercepting traffic.
Privacy monitor (macOS)
Tracks who hits your camera, mic, clipboard and screen-capture through TCC — alerts when a process accesses them with no reason.
Injection detector
Heuristics for in-memory process injection (LD_PRELOAD, dyld interposing, unusual RWX). Stops implants that have no signature.
Encrypted backup
One-command export of config + critical data to an encrypted ZIP. One-command restore — essential before any lockdown toggle.
Native multi-OS
macOS, Linux, Windows. Daemon (launchd / systemd / Scheduled Task) + rich CLI + consistent PyQt6 GUI everywhere.
Security Dome
A unified console to run your security posture
System score, lockdown, honeypots, vuln scanning, threat hunting — all in one console above the detection engine.
Security score 0–100
Instant system audit with A+/A/B/C/D/F grade + actionable recommendations (firewall, FileVault, SIP, updates, gatekeeper…).
Lockdown mode
One toggle to harden: strict firewall, auto-kill suspicious processes, cascading IP blocks, DND off. Reversible in one click.
Honeypots & canary files
Trap files placed in Documents, Desktop, iCloud. Any read/write raises an instant alert — the fastest ransomware signal you'll get.
CVE scanner
Enumerates installed software and cross-checks against the official NVD feed. You see exactly which apps have open critical CVEs.
Threat hunting DSL
Mini query language over your history: `detections WHERE severity=critical SINCE 7d`. Ready-made and saved queries included.
Autonomous Claude agent
Launches a Claude investigation on your open alerts, correlates events, proposes YARA rules and a remediation plan.
Immutable audit log
Every critical action (quarantine, IP block, privilege change, lockdown) is written to a hash-chained journal. Any tampering with the history is instantly detectable. Forensics-grade.
Honey credentials
Fake AWS, GitHub, SSH tokens and `.env` files dropped into your dev folders. Any read triggers an instant alert — an infostealer outs itself before it even exfiltrates.
Anti-uninstall & self-healing
Luna watches its own bundle and modules: if an attacker tries to disable or uninstall the AV, Luna alerts, restarts and restores its critical files. The AV repairs itself.
Datenschutz
Your scans stay local
No file is uploaded to our servers. AI analyses are opt-in and only send Claude an anonymised technical summary (hash, metadata, behaviour) — never your content.
Jetzt verfügbar
Download Luna
macOS · Linux · Windows. Open-source, one-command install.
Terms & legal notice
What you agree to when installing Luna
Luna is free and open-source, but the rules are still spelled out. Everything is one click away below.
Privacy policy
Luna is designed to stay local. Scans run entirely on your machine — no file is ever sent to our servers. The app collects no name, email or identifier. The only outbound connections are: (1) downloading signature and threat-intelligence updates from public sources (URLhaus, abuse.ch, ClamAV); (2) optional request to the Anthropic Claude API for AI analysis (strictly opt-in); (3) optional request to VirusTotal for multi-AV check (opt-in). No tracking pixel, no analytics, no mandatory telemetry. Every outbound connection can be disabled in Settings.
Data sent to Claude AI (Anthropic)
Claude analysis is strictly opt-in via Settings > AI analysis. When enabled, Luna sends Anthropic only an anonymised technical summary: SHA-256 hash of the suspect file, system metadata (size, extension, permissions), behavioural traces (syscalls, observed network connections) and other-engine verdicts (YARA, ClamAV, ML). The file's content is never transmitted. Anthropic processes the request under its own privacy policy (anthropic.com/privacy). You can disable AI analysis at any time with no loss of functionality — the other layers keep running.
Terms of use
Luna is provided to you for free, for personal or commercial use, with no signup. By installing it you agree to: (1) not use it for illegal activities or activities infringing third-party rights; (2) not redistribute a modified version under the names "Luna" or "OmniX" without written authorisation; (3) acknowledge that Luna is a complementary defence layer and does not replace fundamental good practices (OS updates, regular backups, strong passwords, phishing vigilance).
License & third-party components
Luna is released under the MIT license. The source code is available at github.com/OmniXAIapps/luna and the LICENSE file contains the full text. Luna integrates the following third-party components: ClamAV (GPLv2), YARA (BSD-3-Clause), PyQt6 (GPLv3), scikit-learn (BSD-3-Clause), psutil (BSD-3-Clause), MalwareBazaar / URLhaus / abuse.ch feeds (CC0), VirusTotal API (under VT terms), Anthropic Claude API (under Anthropic terms), Lima (Apache 2.0) for the macOS VM sandbox, Docker Engine (Apache 2.0) for the Linux / Windows sandbox, Apple's EndpointSecurity framework (under Apple Developer Program terms) for the macOS System Extension. Full third-party notices are listed in THIRD_PARTY_LICENSES.md in the repo.
Vulnerability disclosure policy
Found a security flaw in Luna? Email security@omnixapps.com with a reproducible technical description. We reply within 72 business hours and coordinate responsible disclosure: a fix is prepared and shipped before any public communication, and you are credited (with your consent) in the CHANGELOG. No bug bounty for now — but clear acknowledgement and a sincere thank you.
Warranty & limitation of liability
Luna is provided "as is", without express or implied warranty of operation, merchantability or fitness for a particular purpose. No antivirus catches 100% of threats — Luna significantly reduces risk but does not eliminate it. OmniX AI shall not be held liable for any direct, indirect, incidental or consequential damages (data loss, system unavailability, information leakage, etc.) arising from the use of, inability to use, or non-detection of a threat by Luna. The user remains solely responsible for backups and the overall security of their machine.
Legal notice
Publisher: OmniX AI · Contact: support@omnixapps.com · Site: https://omnixapps.com · Luna binary distribution: GitHub Releases (github.com/OmniXAIapps/luna) — GitHub Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA. Hosting for omnixapps.com: Cloudflare Pages (Cloudflare Inc., 101 Townsend St, San Francisco, CA 94107, USA). Luna is not specifically intended for minors; using it implies being of legal age to operate an OS and to accept these terms.
Need help?
Docs, FAQ, bug reports — we answer within 24-48 business hours.
