mallcop

Documentation

Everything you need to install, configure, and run mallcop. Full source and docs are also on GitHub.

Guides & Reference

Quick Start Guide

Step-by-step from install to automated monitoring.

  • Install
  • Create a store repo
  • Initialize (mallcop init scaffolds mallcop.yaml)
  • First scan
  • Automate: cron, or a scheduled GitHub Action
  • Learning mode, then full severity
  • Review findings

Configuration Reference

mallcop.yaml is the primary config path — every flag and environment variable too.

  • Writing config: config set connector / autonomy
  • Inference env vars (bring your own)
  • GitHub App auth
  • Choosing a connector
  • The git store (--store)
  • Detector tuning & circuit breaker

Connector Catalog

Auth setup, event types, and configuration for each connector.

  • File / stdin - --events <jsonl> (built in)
  • GitHub - org events via GitHub App (built in)
  • AWS, Azure, GCP, M365, Okta - via the mallcop-connectors repo (shipped)

Detector Catalog

What each of the 17 built-in detectors catches and how to tune it.

  • new-actor
  • priv-escalation
  • new-external-access
  • unusual-resource-access
  • unusual-timing
  • volume-anomaly
  • secrets-exposure, exfil-pattern
  • auth-failure-burst, rate-anomaly
  • config-drift, dependency-tamper, git-oops, and more

CLI Reference

Every mallcop command with flags, options, and examples.

  • Pipeline: init, scan, detect
  • Inspection: status, config
  • scan runs connect → detect → triage → investigate → consensus
  • Continuous monitoring = schedule scan (cron)

Self-Improvement

How mallcop learns to detect anything — with real demos you can run.

  • The scan → collect → propose → gate → route loop
  • Data lane (safe) vs. code lane (gated)
  • Free OSS / donut / bring-your-own-inference
  • Live demo: a tuning overlay flips PE-08 green
  • The safety gate: consensus is never suppressed