mallcop

module

v0.6.0 Latest Latest Go to latest Published: May 13, 2026 License: MIT

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/mallcop-app/mallcop

Links

Open Source Insights

README ¶

mallcop-legion

Go binary — mallcop security scanner on legion runtime. Contains chart config, CLI wrapper, and mallcop-specific tools invoked by legion workers.

Overview

mallcop-legion integrates the mallcop security scanner with the legion automaton runtime. It provides:

Chart configuration for legion-based connector factory workers
CLI wrapper that dispatches mallcop scans via legion
Mallcop-specific tool implementations invoked by legion workers

Architecture

mallcop CLI
  → mallcop-legion (this repo)
    → legion runtime
      → mallcop-connectors (data fetching)
      → mallcop-skills (detection, analysis)
        → Forge API (metering, inference)

Cross-repo architecture: ~/projects/mallcop-pro/CLAUDE.md
Parent work item: mallcoppro-eb1
mallcop OSS: https://github.com/thirdiv/mallcop
mallcop-connectors: https://github.com/thirdiv/mallcop-connectors
mallcop-skills: https://github.com/thirdiv/mallcop-skills

License

Directories ¶

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL

Path	Synopsis
cmd
baseline command Command baseline builds and queries mallcop baseline frequency tables.	Command baseline builds and queries mallcop baseline frequency tables.
detector-config-drift command detector-config-drift reads events JSONL from stdin and emits findings JSONL to stdout for configuration change events: security group modifications, IAM policy changes, MFA disabling, and audit log modifications.	detector-config-drift reads events JSONL from stdin and emits findings JSONL to stdout for configuration change events: security group modifications, IAM policy changes, MFA disabling, and audit log modifications.
detector-dependency-tamper command detector-dependency-tamper reads events JSONL from stdin and emits findings JSONL to stdout for dependency supply chain tampering: package version changes, unexpected additions, hash mismatches, and typosquatting indicators.	detector-dependency-tamper reads events JSONL from stdin and emits findings JSONL to stdout for dependency supply chain tampering: package version changes, unexpected additions, hash mismatches, and typosquatting indicators.
detector-exfil-pattern command detector-exfil-pattern reads events JSONL from stdin and emits findings JSONL to stdout for events that indicate data exfiltration: unusual outbound data volumes, bulk access to many resources in a short window, or download events that exceed baseline frequency thresholds.	detector-exfil-pattern reads events JSONL from stdin and emits findings JSONL to stdout for events that indicate data exfiltration: unusual outbound data volumes, bulk access to many resources in a short window, or download events that exceed baseline frequency thresholds.
detector-git-oops command detector-git-oops reads events JSONL from stdin and emits findings JSONL to stdout for dangerous git operations: force pushes, branch deletions, and commit messages containing secret-looking strings.	detector-git-oops reads events JSONL from stdin and emits findings JSONL to stdout for dangerous git operations: force pushes, branch deletions, and commit messages containing secret-looking strings.
detector-injection-probe command detector-injection-probe reads events JSONL from stdin and emits findings JSONL to stdout for events that contain prompt injection attempts in their payload fields.	detector-injection-probe reads events JSONL from stdin and emits findings JSONL to stdout for events that contain prompt injection attempts in their payload fields.
detector-malicious-skill command detector-malicious-skill reads events JSONL from stdin and emits findings JSONL to stdout for skill-related events that contain suspicious URLs, encoded payloads, or excessive permission requests.	detector-malicious-skill reads events JSONL from stdin and emits findings JSONL to stdout for skill-related events that contain suspicious URLs, encoded payloads, or excessive permission requests.
detector-new-actor command detector-new-actor reads events JSONL from stdin, compares each actor against the baseline known-actors set, and emits findings JSONL to stdout for actors not seen in the baseline period.	detector-new-actor reads events JSONL from stdin, compares each actor against the baseline known-actors set, and emits findings JSONL to stdout for actors not seen in the baseline period.
detector-priv-escalation command detector-priv-escalation reads events JSONL from stdin and emits findings JSONL to stdout for events that indicate a privilege escalation — role grants, permission changes, or admin promotions — not already in the baseline.	detector-priv-escalation reads events JSONL from stdin and emits findings JSONL to stdout for events that indicate a privilege escalation — role grants, permission changes, or admin promotions — not already in the baseline.
detector-rate-anomaly command detector-rate-anomaly reads events JSONL from stdin and emits findings JSONL to stdout for events that show API rate anomalies: burst requests, orders-of-magnitude jumps above baseline, or unusual endpoint access patterns.	detector-rate-anomaly reads events JSONL from stdin and emits findings JSONL to stdout for events that show API rate anomalies: burst requests, orders-of-magnitude jumps above baseline, or unusual endpoint access patterns.
detector-secrets-exposure command detector-secrets-exposure reads events JSONL from stdin and emits findings JSONL to stdout when event payload fields contain secrets in cleartext: API keys, tokens, passwords, and credentials matching known formats.	detector-secrets-exposure reads events JSONL from stdin and emits findings JSONL to stdout when event payload fields contain secrets in cleartext: API keys, tokens, passwords, and credentials matching known formats.
detector-unusual-login command detector-unusual-login reads events JSONL from stdin, compares each login event against a baseline of known user patterns, and emits findings JSONL to stdout for logins that deviate from baseline.	detector-unusual-login reads events JSONL from stdin, compares each login event against a baseline of known user patterns, and emits findings JSONL to stdout for logins that deviate from baseline.
detector-unusual-timing command detector-unusual-timing reads events JSONL from stdin and emits findings JSONL to stdout for events that occur at UTC hours not seen for that actor in the baseline period.	detector-unusual-timing reads events JSONL from stdin and emits findings JSONL to stdout for events that occur at UTC hours not seen for that actor in the baseline period.
detector-volume-anomaly command detector-volume-anomaly reads events JSONL from stdin, counts events per (source, event_type) group, and emits findings JSONL to stdout when the observed count exceeds 3× the baseline count for that group.	detector-volume-anomaly reads events JSONL from stdin, counts events per (source, event_type) group, and emits findings JSONL to stdout when the observed count exceeds 3× the baseline count for that group.
exam-render-chart command cmd/exam-render-chart renders charts/exam.toml.tmpl into a ready-to-boot legion chart for a specific exam run.	cmd/exam-render-chart renders charts/exam.toml.tmpl into a ready-to-boot legion chart for a specific exam run.
exam-seed command Command exam-seed walks exams/scenarios/, loads each YAML via internal/exam.Load, materializes fixture files, and posts work:create messages to a campfire for each scenario plus one final exam:report item.	Command exam-seed walks exams/scenarios/, loads each YAML via internal/exam.Load, materializes fixture files, and posts work:create messages to a campfire for each scenario plus one final exam:report item.
exam-transcript-dump command cmd/exam-transcript-dump renders a judge-visible Markdown transcript from exam fixture data and a heal disposition's resolution JSON.	cmd/exam-transcript-dump renders a judge-visible Markdown transcript from exam fixture data and a heal disposition's resolution JSON.
mallcop command Command mallcop is the customer-facing CLI for running mallcop scans.	Command mallcop is the customer-facing CLI for running mallcop scans.
mallcop-academy command forge_usage.go — per-scenario Forge usage querying for mallcop-academy.	forge_usage.go — per-scenario Forge usage querying for mallcop-academy.
mallcop-checklist-verify command Command mallcop-checklist-verify is a veracity-gate hook CLI that blocks a disposition from closing a bead unless it has emitted all required Pre-Resolution Checklist items to the engagement campfire.	Command mallcop-checklist-verify is a veracity-gate hook CLI that blocks a disposition from closing a bead unless it has emitted all required Pre-Resolution Checklist items to the engagement campfire.
mallcop-coverage-tripwire command
mallcop-credential-theft-verify command Command mallcop-credential-theft-verify is a veracity-gate hook binary that enforces the Credential Theft Test rule from the investigate disposition.	Command mallcop-credential-theft-verify is a veracity-gate hook binary that enforces the Credential Theft Test rule from the investigate disposition.
mallcop-exam-report command Command mallcop-exam-report aggregates judge:verdict messages from a campfire into a structured exam report (report.json + report.md).	Command mallcop-exam-report aggregates judge:verdict messages from a campfire into a structured exam report (report.json + report.md).
mallcop-finding-context command
mallcop-investigate-tools command Package main implements mallcop-investigate-tools — a single read-only binary used by the investigate (and triage) dispositions to query fixture data without network egress or shell escapes.	Package main implements mallcop-investigate-tools — a single read-only binary used by the investigate (and triage) dispositions to query fixture data without network egress or shell escapes.
notify-email command
notify-slack command
notify-teams command
notify-telegram command
internal
exam Package exam provides types and loader logic for mallcop exam scenarios.	Package exam provides types and loader logic for mallcop exam scenarios.
testutil/cannedbackend Package cannedbackend provides a minimal HTTP server that mimics Forge's /v1/chat/completions and /v1/messages endpoints for integration and e2e tests.	Package cannedbackend provides a minimal HTTP server that mimics Forge's /v1/chat/completions and /v1/messages endpoints for integration and e2e tests.
pkg
baseline
event
finding
resolution