CLI Reference

mallcop init

Scaffold mallcop.yaml, the findings store, and a sample events file, then print runnable next steps.

mallcop init          # or: mallcop init --dir path/to/deployment

Creates mallcop.yaml (the primary, zero-flag config path), a store/ directory (the git-native findings store), and a sample events.jsonl, then prints the exact next-step commands. A bare mallcop scan afterward reads mallcop.yaml; flags plus the MALLCOP_INFERENCE_URL / MALLCOP_API_KEY environment variables still work and override it (see Configuration).

--create-repo is the fastest path to continuous monitoring: the scheduled .github/workflows/scan.yml Action it scaffolds replaces a hand-written cron entry (see Continuous monitoring below).

mallcop scan

The core command. Runs the full pipeline end to end and writes to --store.

# scan a GitHub org (--store is required)
mallcop scan --connector github --github-org YOUR_ORG --store ./store

# or read events from a file / stdin
mallcop scan --events events.jsonl --store ./store

A single mallcop scan runs the whole pipeline: connect (pull events from the chosen connector), detect (run the 17 detectors against the baseline), triage and investigate (the AI cascade), and committee consensus (independent re-votes before anything resolves benign). Findings and resolutions are written to the git store at --store. Schedule it via cron for continuous monitoring. Exit codes: 0 no findings, 1 findings present, 2 scan failure.

Inference auth comes from $MALLCOP_INFERENCE_URL + $MALLCOP_API_KEY (a vendor URL + key for BYOK, or the mallcop endpoint + your mallcop-sk-* key). With no inference URL set, every finding force-escalates — the documented fail-safe.

mallcop detect

Run only the offline detection phase — no inference key, no store.

cat events.jsonl | mallcop detect > findings.jsonl

Reads events JSONL from stdin and writes findings JSONL to stdout, running the 17 built-in detectors against the baseline with no AI cascade and no inference key. The integrated command most users want is mallcop scan, which runs detection plus the cascade and consensus and persists to the store; mallcop detect is the pure, pipeable rule-based step. Accepts --baseline and --tuning.

mallcop status

Event and finding counts, and operational status.

mallcop status --store ./store

Shows total events, total findings, events by source, and findings by status — a quick health read of the git store. --store is required.

mallcop config

Print the effective config merged from a discovered mallcop.yaml plus the environment.

mallcop config

Prints the full merged config a scan would pick up right now — config file path, inference mode/URL/key/model, store path, connectors, detectors, learning autonomy, sovereignty, and budgets. See Configuration for the full transcript, before and after mallcop init.

mallcop config set

Write a strict-validated change directly into mallcop.yaml.

mallcop config set connector --kind=file|github|cloud --id=<id> [--path=][--org=][--source=][--binary=][--since=][--args=a,b][--env=NAME1,NAME2]
mallcop config set autonomy <non|semi|fully>

config set connector adds a connector to mallcop.yaml (atomic write; rejects a duplicate id, an unknown kind, or an inline secret in --env). config set autonomy sets learning.autonomy (strict enum). Both are the shared primitives any driver of a config change — this CLI or a chat surface — calls; see Configuration for real output and Self-Improvement for the autonomy dial.

mallcop feedback

Record an operator decision on a finding — the "silence this" mechanism.

# approve = activity is known-good; dismiss = not actionable
mallcop feedback <finding_id> dismiss --store ./store --reason "known onboarding"

Both verbs persist a suppress directive keyed on the finding's source/type/actor to the store's directives.jsonl. The next mallcop scan reads that directive and drops future findings of that class — so once you rule on something, mallcop stops re-flagging it. This is the CLI half of the review loop; the hosted mallcop.app chat writes the same directives back to your repo over GitOps.

mallcop exam-detect

Grade the offline detect layer against the labeled exam corpus.

mallcop exam-detect                              # baseline grade
mallcop exam-detect --tuning detectors/tuning.yaml  # grade WITH an overlay applied

Runs the detectors over every labeled exam scenario and reports per-scenario pass/fail. Offline and deterministic — no inference key. Exit 1 signals an open detection gap. See Self-Improvement for the live PE-08 demo.

mallcop collect

Mine a scan's store for coverage gaps — the self-extension feedstock.

mallcop collect --store ./store --json

Emits a versioned envelope {schema_version, mapping_gaps, gap_candidates} — the stable, offline input the self-extension proposer consumes. No inference key.

mallcop validate-proposal

Run the free, $0, no-inference gate over a self-extension proposal diff.

mallcop validate-proposal --base <ref> --head <ref> --json

Runs ordered $0 stages over a real git diff — guard (protected paths frozen, YAML may only widen), structural (builds + import allow-list), and exam-detect (no regression, at least one gap closed). Run from inside the repo being validated. Exit 1 = rejected. The metered proposer and code-authoring lanes that produce these diffs run via the mallcop-ops selfext operator binary — see Self-Improvement.

Continuous monitoring

There is no mallcop watch command and no daemon. Continuous monitoring is just mallcop scan on a schedule you control. The recommended path is mallcop init --create-repo owner/name (see init above): it scaffolds a scheduled .github/workflows/scan.yml GitHub Action into a real deployment repo it creates and pushes for you — no server, no cron to babysit.

Prefer to run it yourself (e.g. no GitHub Actions), cron works the same way. For example, scan your GitHub org every six hours:

# crontab -e
0 */6 * * *  cd /path/to/deployment && mallcop scan --connector github --github-org YOUR_ORG --store ./store