Magika

Magika is a file type detection tool built by Google that uses a small deep learning model instead of signature or heuristic matching. It's for developers, security teams, and anyone who needs to identify file types accurately and quickly, whether that's a single file or millions of them. It ships as a Rust-based CLI, with bindings for Python, JavaScript/TypeScript, and an experimental Go package.

Unlike traditional tools such as file or libmagic, Magika uses a model trained on roughly 100 million samples spanning over 200 content types, covering both binary and textual formats. On its test set it reports around 99% average precision and recall, with notable gains on textual content types where byte-pattern matching tends to struggle. The model itself is only a few megabytes and runs inference in about 5ms per file after the initial load, even on a single CPU.

Key features

• Deep learning classification: uses a custom, optimized model rather than magic-byte signatures, improving accuracy on ambiguous and textual files.
• Multiple interfaces: available as a Rust CLI, Python API, JavaScript/TypeScript package, and an experimental Go binding.
• Fast inference: near-constant detection time regardless of file size, since Magika only reads a limited portion of the file's content.
• Batch and recursive scanning: handles thousands of files in one invocation and supports recursive directory scans with -r.
• Confidence-based output: a per-content-type threshold system decides whether to trust a prediction or fall back to a generic label like "Unknown binary data".
• Configurable prediction modes: high-confidence, medium-confidence, and best-guess modes let you tune the tradeoff between precision and coverage.
• Flexible output formats: supports plain text, JSON, JSONL, and custom format strings with placeholders for label, MIME type, description, extensions, group, and score.
• Proven at scale: used internally by Google to route Gmail, Drive, and Safe Browsing files to security scanners, and integrated into VirusTotal and abuse.ch.

Ideal use cases

Magika fits well in security pipelines that need to classify large volumes of untrusted files before routing them to scanners, malware analysis, or content policy checks. It's also useful for digital forensics, data loss prevention, and any ingestion pipeline where file extensions can't be trusted and accurate MIME type or content-type detection matters. Its speed and low memory footprint make it a reasonable drop-in for file/libmagic style type detection within CI tools, file upload validators, or archive processing scripts.

It's less of a fit if you need detection of highly specialized or proprietary binary formats outside its 200+ trained content types, since the model will fall back to a generic label like "Unknown binary data" when confidence is low. It's also not designed as a full malware scanner or content validator; it identifies type, not malicious intent. If you need exact byte-for-byte format validation (like strict schema checking of a file format), pair Magika with a format-specific parser rather than relying on it alone.

Installation

The CLI is written in Rust and can be installed several ways:

Via the magika Python package:

pipx install magika

Via Homebrew (macOS / Linux):

brew install magika

Via installer script (macOS/Linux):

curl -LsSf https://securityresearch.google/magika/install.sh | sh

Or on Windows (PowerShell):

powershell -ExecutionPolicy Bypass -c "irm https://securityresearch.google/magika/install.ps1 | iex"

Via the magika-cli Rust package:

cargo install --locked magika-cli

For the Python package:

pip install magika

For the JavaScript package:

npm install magika

Once installed, run it against files or directories:

magika -r some_directory/

Or use the Python API:

from magika import Magika
m = Magika()
res = m.identify_path('./file.ini')
print(res.output.label)

Use --json or --jsonl for structured output, or --format with placeholders like %l, %m, and %s for custom formatting.