mallcop chat

mallcop/ chat

🍩—donuts

Buy

Not connected — mallcop can't see your findings yet.

Let's connect mallcop to your code

mallcop scans a repository you control and writes findings back to it. Connect that repo and I can triage it with you — grounded in your real scan, never made up. Three steps:

Install the mallcop CLI

curl -fsSL https://mallcop.app/install.sh | sh

No prebuilt binary? go install github.com/mallcop-app/mallcop/cmd/mallcop@latest also works.
Create your monitoring repo — it scans hourly and publishes findings to GitHub

export MALLCOP_GITHUB_TOKEN=$(gh auth token)

mallcop init --create-repo YOUR_ORG/mallcop --pro

This scaffolds a repo whose workflow runs mallcop scan on a schedule and pushes results to the mallcop-findings branch. Add your MALLCOP_API_KEY (from the dashboard) as a repo secret so scans can run.

Just trying it locally? mallcop init && mallcop scan scans without GitHub — but connect the repo below to see findings here.
Connect that repo here

Enter YOUR_ORG/mallcop — I read findings.json from the mallcop-findings branch (add a GitHub token for private repos). Then ask me "what's critical?"

Just exploring? · Full install guide

Account & connection

Signed in as

Your findings repo

The repo mallcop publishes to — I read findings.json from its mallcop-findings branch (falling back to the default branch). A token is only needed for private repos — it stays in your browser and is sent straight to GitHub, never to us.

Reconfigure

Ask in plain English to change mallcop.yaml — add a connector, set autonomy, or turn contribute-back on/off. I PROPOSE the change (never mutating); you review and Apply, and the approved edit is committed back to your own repo. Config actions authenticate with your API key.

Self-improvement

Ask mallcop to author a new detector for your connected repo. mallcop dispatches a CODE-lane run in YOUR repo and opens a reviewed pull request — it never merges on its own. Requires signing in with GitHub (uses your connected repo, not the API key above).

Once one of YOUR authored detectors has merged, you can share it back to the commons — mallcop opens a REVIEWED pull request to the shared OSS corpus and never merges it (the OSS project's own exam + code-owner review decides). Contribute-back is off by default; turn it on with contribute back on in Reconfigure above.