Raven Forge · Free for households
Roost is a free desktop app that finds every device on your home network, reads your router's real settings, and hands you a ranked list of what is exposed. Each one in plain English, each backed by evidence, each with a fix it walks you through.
No account · No signup · Nothing about your home leaves your computer
Twelve devices on the example network. Roost names the maker even when the device will not say what it is.
Sixty seconds, no configuration
Four passes, quietest first: a rate limited nudge so your computer's own network stack resolves the subnet, the neighbour table, then two multicast questions the devices answer themselves.
What your router publishes to anything on the network needs no password, including the list of doors it is holding open. With your password it reads the settings themselves, and only ever reads.
Every finding says what someone could actually do, shows the observation it came from, and carries a numbered fix with a realistic time on it.
The app
This is the first screen after a scan. Three devices need attention, one of them can be reached from the internet, and nine had nothing found. Roost puts the list first because a number is memorable and a list is actionable.
One of them can be reached from the internet.
The Roost interface, rebuilt from the product's own design tokens with the example network from the design brief. Not a screenshot.
The score, in its place
The Home Score is supporting evidence for the list, not a headline. It is derived from what is still open and the weights in the signed check pack, and it is recomputed every time rather than stored, so fixing something moves it and a setting that comes back moves it down again.
A device counts once, at its worst finding. Two problems on one camera are still one camera to fix, and a score that punished twice would misrank the list it exists to support.
There are three status levels and never four: urgent, needs attention, looks OK. Every one of them carries an icon and a text label, because a coloured dot on its own is unreadable to a large number of people.
How the ranking worksFixing the camera's forwarded port takes this to 83. The number is recomputed from what is still open, never stored.
The Roost interface, rebuilt from the product's own design tokens with the example network from the design brief. Not a screenshot.
Evidence, every time
Every finding carries a real observation, a timestamp and its source. A rule that cannot fill in its own evidence fails validation instead of rendering, so there is no such thing in Roost as a warning with nothing behind it.
Someone could reach its login page and try known passwords for this model.
Your router is forwarding outside traffic on port 8080 straight to this camera. Anyone who finds your home's IP address can try to open its login page.
The Roost interface, rebuilt from the product's own design tokens with the example network from the design brief. Not a screenshot.
What leaves your computer
No account, no signup, no telemetry, no crash reporting, no analytics. Roost is not a service with a desktop client. It is a program on your machine that reads your own network and writes the answer to your own disk.
That is enforced rather than promised. Everything Roost may reach is decided by one setting and passes through one function, checked by purpose and by host, https only, no redirects, size capped. An allowlisted host that no code actually uses is treated as a defect, because a promise widened for nothing is still widened.
How that is enforcedThe three postures
Check packs are never downloaded. A pack is a file you choose, its signature is verified with a pinned key before anything parses it, and there is no host for one in the allowlist.
What it looks at
Over IPv4 and IPv6, from the neighbour tables, mDNS and SSDP, and by listening to what devices announce unasked. 33 classes, 108 fingerprints.
Eleven brands the pack knows, four readers written, and a screen that says which of them has ever met real hardware.
Twenty rules, three severity levels, and a weight per finding that comes from the signed pack rather than from the binary.
A real observation, a timestamp and its source on every finding, and a refusal to render one that has none.
Numbered steps, what you should see when a step has worked, and a real re-check at the end instead of taking your word for it.
Encryption read from this computer's own connection, so it works on the ISP box no reader can log in to. WPS, DMZ, guest isolation, and the rest.
A map you can zoom, pan and click, drawn from real geography that ships inside the app. It also says what it cannot see.
First-seen dates that survive runs, so new this week is real, and a fix that comes back is the same finding returning rather than a new one.
One self-contained file with nothing to fetch, hardware addresses off by default, and a phone viewer that can only ever look.
Read only
Not on your router, not on a device. The interface a router reader implements has three methods, connect, read the settings, read the forwarding table, and no fourth, so there is no write path to misuse. The SOAP client will only send actions whose name begins with Get.
This is why a household can be told to trust it with a router password. The fix walkthrough opens the right page on your own router and tells you what to click; Roost does not log in and change it for you, and it does not block, quarantine or cut off a device.
And it will not overstate
Get it
Free, and free means free: no account, no trial, no card, no feature held back behind a signup. What the app finds today, it finds for everyone.
macOS 12 Monterey or later. Apple silicon and Intel.
The bundle builds and runs, and it is not yet signed or notarised, so macOS would refuse to open it.
Release pageWindows 10 version 1809 or later, 64 bit. WebView2, which Windows 11 already has.
The installer is not Authenticode signed yet, so SmartScreen would warn every household that downloaded it.
Release pageA glibc distribution with WebKitGTK 4.1: Ubuntu 22.04 or later, Fedora 38 or later, Debian 12 or later.
There is no package yet. The Linux CI lane compiles the core; the .deb, .rpm and AppImage are not built.
Release pageWhere this stands today
A security product whose first instruction is to override the operating system's own warning has taught its user the wrong habit. So there is no unsigned installer here. The full state of it, how to build from source in four commands, and what each platform will ask you for, are on the download page.
