# DESA - Dynamic Encoded Script Analysis

DESA is the PlatPhormNews public-safe deterministic encoded-script analysis workbench.

Purpose: static PowerShell and encoded-script triage, Base64/UTF-16LE decoding, IOC extraction, detection-rule explanation, risk scoring, safe exports, and MCP/API tooling.

Safety:
- Static analysis only.
- Submitted scripts are never executed.
- PowerShell is never invoked.
- Embedded URLs are extracted as IOCs but never auto-fetched.
- Public URL fetches are SSRF-protected, size-limited, timeout-limited, and do not follow redirects.

Capabilities:
- Analyzer: PowerShell encoded-command detection; Base64 and UTF-16LE decoding; hex and character-code deobfuscation; suspicious token and command-line flag matching; IOC extraction; deterministic risk scoring; MITRE-style rule mapping where rules support it
- Rules: 20 active deterministic rules from server storage or built-in degraded fallback.
- Samples: 2 public-safe static samples.
- Integrations: JSON Tree (degraded-capable), ASCII Converter (degraded-capable), XML Validator (degraded-capable), MCP Tools (read-only-capable), Trace (scaffolded), Docs (scaffolded), Sheets (scaffolded), Decks (scaffolded).
- Model state: degraded; deterministic fallback remains active.

Public endpoints:
- /: Analyze
- /analyze: Analyze Workbench
- /iocs: IOCs
- /history: History
- /rules: Detection Rules
- /integrations: Integrations
- /docs: Docs
- /settings: Settings
- /faq: FAQ
- /guidance: Guidance
- /roadmap: Roadmap
- /contributors: Contributors
- /privacy: Privacy
- /license: License
- /api/docs: API Docs
- /openapi.json: OpenAPI JSON
- /openapi.yaml: OpenAPI YAML
- /llms.txt: LLMs.txt
- /llms-full.txt: Full LLM Context
- /llms-index.json: LLMs Index
- /rss.xml: RSS
- /feed.xml: Feed
- /sitemap.xml: Sitemap
- /sitemap-main.xml: Main Sitemap
- /robots.txt: Robots
- /manifest.webmanifest: Web Manifest
- /humans.txt: Humans
- /.well-known/mcp.json: MCP Well-Known
- /.well-known/agents.json: Agents Well-Known
- /.well-known/ai-plugin.json: AI Plugin
- /.well-known/security.txt: Security Contact
- /.well-known/trust.json: Trust Policy

MCP endpoint: https://desa.platphormnews.com/api/mcp
OpenAPI: https://desa.platphormnews.com/openapi.yaml
Auth policy: public-safe by default; future protected actions use PLATPHORM_API_KEY only.
Trace policy: W3C trace context is accepted and propagated through DESA operation metadata.