Matlock Logo Matlock
Free Scan
ON-PAGE APPLIANCE DOCUMENTATION

How Matlock Works in Practice (2-Minute Setup)

Matlock — Agent & Developer Tools. Efficient. Exact. By the book. Point Matlock at any project folder for < 50ms AST, MITRE CWE, IEEE Std 1003.1 POSIX, CISA SSDF, and AICPA SOC 2 TSC verification, Safeguard test protection, Cold Box sandboxes, and GitHub Action PR provenance.

Manual → Command Center → Field Notes → Support Box →

01 · Run a Sub-50ms Local Source & Pre-CI Scan

Select any local project folder via Browse (or drop it into the Browser WASM scanner) and run Matlock. Matlock scans your source tree directly in local memory in milliseconds — surfacing untested Dark Code files, oversized monolithic modules, exposed secrets (exact relative folder/file:line shown free on Code Health Reports, never secret values), and standards-anchored pre-commit checks with 0 bytes sent to Matlock. Matlock evaluates technical codebase and pipeline controls against MITRE CWE, CISA SSDF, IEEE Std 1003.1 POSIX, automated Pre-CI integrity gates, and AICPA SOC 2 Trust Services Criteria technical controls (technical controls only; not a CPA certification).

02 · 27-Tool Local & Cloud Headless MCP (Settings -> AI Agent (MCP))

Matlock only reads your project by default (if you turn on Restore in Settings, it restores a recorded test only after you approve a line-by-line preview). Follow Top Point Bounties, click Copy Agent Prompt, or open Settings -> AI Agent (MCP) to switch on MCP Server (stdio) and optional Agent Email Bridge (or launch matlock-mcp --stdio --headless in Linux, macOS arm64, Windows, or cloud containers) across Kimi Code CLI, Qwen Code, DeepSeek, Antigravity, VS Code, Visual Studio, Cursor, Windsurf, Cline, Claude Code, Gemini, Copilot, Android Studio, IntelliJ, Ollama, vLLM, SGLang, or LM Studio. Assistants can run < 50ms matlock_run_scan, verify a single test file via matlock_run_sequence(file: ""), launch non-blocking runs with async: true (auto-waking on finish or polling compact capsules via matlock_get_action_status), and halt active runs via stop_sequence (matlock_stop_action). Press ? or F1 in the app, call matlock_read_appliance_manual (0 credits), or share /en/manual.md with any chat AI.

03 · Action Cards, Save Points, Email Alerts & PR Provenance Badge

Click Matlock in the left rail to run Clean -> Get -> Format -> Lint -> Analyze/Build -> Test with coverage in one unified pass, use the always-open docked Terminal and CLI bar (Save as Card and Chain / Alert), or program Action Cards and 20-step Sequences for USB / external drive save points (robocopy /MIR /MT:16 on Windows; rsync -a --delete / / on Linux/GoogleBook), cloud object storage (rclone / AWS S3 / Cloudflare R2 / GCS / Azure Blob), and GitHub push (git push origin main gated by physical Approve & Run human approval on Desktop). Open Settings -> Email Alerts to configure outbound-only Native TLS 1.2/1.3 SMTP using global presets (Gmail / Workspace, Microsoft 365 / Outlook, iCloud, Yahoo, Zoho, QQ / 163 Authorization Code, Fastmail, GMX / Web.de, or local Proton Mail Bridge 127.0.0.1:1025) with App Passwords sealed in your OS keychain/vault, choosing per-step on-error (stop_and_alert / continue_and_alert) or unconditional completion (always / send_alert) triggers. In CI/CD Pull Requests, run Dutchp2p/matlock-public@v1 and cite https://matlock.dutchp2p.com/badge/verified.svg.

04 · Safeguard Rules & Pipelines from AI Tampering

Every Custom Test, Action, Walk-Away Sequence, and Alert defaults to Safeguarded (Read & Run Only), sealed locally in your OS user profile outside the repository (Windows DPAPI + Linux 0600 HMAC-SHA256). Your AI assistant can execute tests and read diagnostics freely, while any unauthorized attempt to edit or weaken a Safeguarded check is immediately detected and held for 1-click restore.

Verified baseline skip (<105ms) + Safeguard & clean-room anomaly latch.

05 · Activate Pro Offline with No Account or Email

Matlock Pro ($24.99 USD/year flat, zero auto-renewal) requires no user account or password. Complete checkout via Pay by Card (MoonPay & Transak), guided PayPal PYUSD transfer (using your existing PayPal balance or debit card), or 1-click Web3 USD stablecoins (Solana USDC, Base USDC, or Polygon USDC): your contiguous 24-character Activation Key (for example, i34324h32HNbN4u9Kp7xYz8Q—double-click to copy) appears immediately on screen with an unlisted /receipt/ record and an optional one-time receipt email from matlock@dutchp2p.com (0-second persistent email storage). Paste the token into Settings -> License -> Activate in the desktop app once to bind a cryptographically signed offline license to your device, including 1 self-service PC transfer per year.

Where Matlock Fits

Three Deployment Realities. One Deterministic Engine.

Built for isolated cloud agent containers, autonomous IDE/M2M loops, and local developer workstations.

01 · Cloud VMs & Long-Horizon Sandboxes

Cloud VMs & Long-Horizon Agent Sandboxes

Container-ready headless MCP for isolated cloud swarms & long-horizon agents. Cloud sandboxes solve execution isolation, not code correctness. A cloud VM stops an agent from wrecking a developer's laptop — not from leaking secrets into a PR, weakening tests to pass a milestone, or burning $500 in tokens re-reading its own mistakes over a 12-hour run. Matlock becomes the deterministic governor inside the container. Because Matlock runs headless, zero-knowledge, and returns compact CWE/POSIX coordinates in under 300 tokens, it acts as the lightweight guardrail that keeps long-horizon cloud agents honest and cheap to run — whether they are spinning inside AWS, Google Cloud, Cloudflare, Azure, Docker, or a local workstation.

02 · IDE MCP & M2M Agent Pipelines

IDE MCP & Autonomous M2M Agent Pipelines

Stacking reviewer LLMs on top of coder LLMs burns 15,000–40,000 tokens per pass and still misses cross-file leaks and races. Matlock Pro ($24.99 USD/yr with unlimited $0.00/run MATLOCK_LICENSE_KEY headless runs and Sync with Headless) offloads AST, MITRE CWE, IEEE POSIX.1, Flutter 3.50, TLS, and Cold Box race checks to < 50 ms native code with exact file:line:col diffs and 2-tier loop breakers.

03 · Solo Developers, Vibe Coders & Leads

Solo Developers, Vibe Coders & Engineering Leads

When agents write thousands of lines in an afternoon, developers shouldn't retype terminal commands, worry about leaked keys on git push, or guess on AICPA SOC 2 TSC or HIPAA technical readiness. Desktop Safeguard blocks silent test weakening, Sync with Headless shares cards two-way, and 1-push USB/Cloud/GitHub routines run with private outbound-only SMTP email alerts and 0 bytes sent externally.

Category Comparison

Matlock Pro vs. CLI Linters vs. Enterprise Cloud Scanners

Deterministic workstation and container verification without manual CLI scripting or per-seat SaaS fees.

Capability Matlock Pro ($24.99 USD/yr) CLI Linters ($0 — Manual) Enterprise Cloud Scanners ($288–$864+/seat/yr)
Annual Pricing $24.99 USD/yr flat · $0 Free Scan $0 manual setup $288–$864+/seat/yr
Cold Box Threaded Sandbox Exposes races & clean-room CI breaks Static lint only Remote queue post-push
Zero-Knowledge Privacy 0 bytes sent externally (workstation or own container) Local, unsealed configs Source uploaded to vendor
Headless & Cloud Containers Local IDE + AWS, GCP, Cloudflare, Azure & Docker Manual container wiring Outbound SaaS tokens
Deterministic Engine Compiled AST binary (not LLM-on-LLM) Single-language rules Cloud rules + metered AI
Token Conservation < 300 tokens vs. 15k–40k LLM avg (up to 95%+ cut*) Raw multi-kB logs Verbose API payloads
Standards & Controls Readiness* MITRE CWE, IEEE POSIX.1, CISA SSDF, AICPA SOC 2 & HIPAA* Syntax & style only Extra compliance tier
Polyglot & Cross-OS 10 language stacks · any target OS 1 tool per language Varies by seat tier
Safeguard Test Protection Blocks silent test weakening or skipping Inline ignores editable No local test seal
Editable 1-Push Routines Sequencer, failure stops & backup/shutdown Manual shell scripts Scanner only
27-Tool MCP & Email Alerts Native stdio MCP + local SMTP reports None Cloud webhooks only
Low CPU/RAM & Updates 1 CPU core kept free · 0 daemons · updates Manual upgrades Background agents
CI / Pull Request Gate & SARIF 2.1.0 Action + verified badge + SARIF (0 upload)* Manual CLI wrapper* Cloud repo access required*

* Token savings vary by repo size and context window. Standards map to MITRE CWE, IEEE Std 1003.1 POSIX, CISA SSDF, AICPA SOC 2 TSC, and HIPAA Security Rule (45 CFR § 164.312) technical safeguards (technical codebase controls only — not formal CPA, HIPAA, or legal certification).

DARK CODE & PRE-CI DIAGNOSTIC GLOSSARY

What AI Dark Code Looks Like, Why It Hurts, and How Matlock Catches It

Concrete production failures introduced during high-speed AI coding sessions—and how Matlock Local Audit + Walk-Away verification stop them before git push.

AI Dark Code Hazard Production & CI Failure Impact Matlock Local Audit & Walk-Away Remedy
1. Untested Dark Code & Silent Error Suppression — AI generates new production services with zero corresponding unit tests, silent error suppression (CWE-391), and unclosed async timers or streams (CWE-401). Silent data loss, frozen UI frames, background memory leaks, and regressions nobody notices until customers hit them in production. Matlock Local Audit cross-references every production file against your test suite and flags silent error suppression and unclosed async handles in compliance with CISA/MITRE CWE benchmarks.
2. 250+ Line God-Objects & // ignore Bypasses — Agents pack 500+ lines of mixed responsibilities into one file, leave unfinished TODO stubs, or add // ignore: comments to silence standard linters. Comprehension debt skyrockets, follow-up AI edits break unrelated features, and unfinished stubs trigger automated App Store or Microsoft Store rejections. Enforces the 250-line compactness ceiling (CWE-1080), ignores inline suppression comments completely, and ranks modular split bounties with 1-click prompts.
3. Cross-OS CI Traps & Leaked Credentials — Cross-platform POSIX path faults that pass on Windows NTFS, CRLF shell scripts, untracked local imports, lockfile drift, or exposed API credentials (CWE-798). Linux GitHub Actions pipelines fail 10 minutes after push, or public repo scrapers harvest exposed keys within seconds of a commit. Standalone Pre-CI gates enforce IEEE POSIX portability specifications, CISA SSDF benchmarks, and automated Pre-CI integrity checks locally before git push ever runs.
OFFICIAL DISTRIBUTION CHANNELS

Download Matlock for Windows, Linux & GoogleBook

Native compiled desktop application. Zero browser dependencies, zero localhost sockets, and free diagnostic scanning forever.

Windows 10 & Windows 11 (x64)

Distributed exclusively through the official Microsoft Store (App ID: 9P5VNWVWLM4N). Signed by Microsoft with automatic background updates and zero SmartScreen warnings.

Linux Desktop & GoogleBook (.deb & AppImage)

Native GTK3 Flutter desktop binary packaged as zero-FUSE matlock-linux-x64.deb (Ubuntu 22.04+, Debian 12+, and GoogleBook Linux) and portable matlock-linux-x64.AppImage (Fedora, Arch, Ubuntu, Debian). AppImage · .deb (GoogleBook / Debian) · SHA256SUMS

chmod +x matlock-linux-x64.AppImage && ./matlock-linux-x64.AppImage
sudo apt install ./matlock-linux-x64.deb

How to Activate or Move Your Matlock Pro License

When you click "Upgrade" inside the Matlock desktop app or visit /en/pricing, a unique contiguous 24-character license key (e.g., i34324h32HNbN4u9Kp7xYz8Q — zero hyphens so double-clicking selects the entire key at once) is generated for your checkout session. Copy and save this key.

Matlock saves a cryptographically signed offline license in private local user-profile storage outside your repository, sealed locally on your computer and verified 100% offline on every start with zero phone-home calls.

2-Line Container & MicroVM Quick-Launch

Vendor-agnostic headless bootstrap for Cloudflare ContainerHarness / Codex cloudflare/debian-trixie, Docker, E2B, and Firecracker (SHA-256 verified):

curl -sSfLO https://matlock.dutchp2p.com/agent-install.sh && curl -sSfLO https://matlock.dutchp2p.com/agent-install.sh.sha256 && (sha256sum -c agent-install.sh.sha256 2>/dev/null || shasum -a 256 -c agent-install.sh.sha256) && sh ./agent-install.sh
export PATH="$HOME/.local/bin:$PATH" && matlock-mcp --stdio --headless --no-coverage
DEVELOPER & AGENT FAQ

Frequently Asked Questions

Direct answers on pre-commit verification, Safeguard test protection, token conservation, compliance readiness, and cloud or local agent setups.

How do I know if my AI-generated code is ready for production?

Run Matlock before every commit or release. In under 50 ms locally or inside your container, Matlock checks ASTs against MITRE CWE, IEEE POSIX.1, CISA SSDF, and 250-line modularity, then runs your compiler and tests in a multi-threaded Cold Box sandbox.

How do I stop coding agents from weakening or skipping tests just to pass?

Matlock Safeguard stores a tamper-evident baseline of verified unit tests in OS storage outside your repository, where inline ignore comments do nothing. If an agent removes, skips, or softens an assertion, Matlock flags it immediately and can restore the original test.

How can I cut my AI coding token and compute bill without stacking agents on top of agents?

Having a second LLM review multi-file edits burns 15,000–40,000 context tokens per pass. Matlock offloads deterministic AST, CWE, and POSIX checks to native code via MCP (matlock_run_scan), returning deduplicated file:line:col coordinates and 5-line repair diffs in under 300 tokens (up to 95%+ reduction).

How do I catch leaked API keys, CWE security bugs, and Linux CI failures before git push?

Run a free in-browser WebAssembly scan on this page (showing exposed secret file:line locations free) or run the Matlock desktop app locally. Matlock catches hardcoded keys (CWE-798), injection sinks, CRLF shell traps, lockfile drift, and Windows-to-Linux path breaks before git push.

Can Matlock be used for HIPAA or AICPA SOC 2 sensitive projects and inside AWS, Google Cloud, or Cloudflare containers?

Yes — 0 bytes of source code are ever sent to Matlock, and MATLOCK_OFFLINE=1 enforces strict air-gap mode inside your workstation or AWS, Google Cloud, Cloudflare, Azure, or Docker container. Matlock evaluates technical code controls mapped to MITRE CWE, CISA SSDF, AICPA SOC 2 TSC, and HIPAA Security Rule (45 CFR 164.312) technical safeguards (technical controls only, not CPA or legal certification).

Which programming languages, operating systems, IDEs, and AI models work with Matlock?

Matlock verifies 10 ecosystems (Dart/Flutter, TypeScript/JS/Node, Python, Rust, Go, Java/Kotlin, C/C++, C#/.NET, SQL, and Shell/YAML/Docker) targeting any OS. Its 27-tool MCP server connects Claude, Gemini, Codex, Cursor, Copilot, Kimi, Qwen, DeepSeek, GLM, Windsurf, Cline, VS Code, JetBrains, and Ollama across Windows 10/11, Linux, GoogleBook, and headless macOS Apple Silicon.

Have a Question, False Positive, or License Note?

Skip email queues and spam filters. Send a question, bug report, or billing note straight into our private support queue with zero account signup.

Open Support & Question Box

Connect Any IDE, Agent Framework, or Cloud Container (20 Providers)

Aider

~/.aider.conf.yml · CLI

Amazon Q Developer

~/.aws/amazonq/mcp.json · IDE / AWS

Antigravity

.mcp.json · Carbon / Hydrogen · Orchestrator

Claude Code

.mcp.json · claude mcp add · CLI / Desktop

Cline / Roo Code

cline_mcp_settings.json · VS Code

Cloudflare ContainerHarness, Sandbox & Browser Run (Kitesurf)

stdio MCP + MATLOCK_LICENSE_KEY · matlock_audit.mjs · Edge / Browser

Codex CLI

~/.codex/config.toml · CLI

Continue

~/.continue/config.yaml · IDE

Copilot (GitHub / VS Code & Agentic Workflows)

.vscode/mcp.json · Dutchp2p/matlock-public@v1 · --format=sarif · IDE / CI

Cursor

.cursor/mcp.json · IDE

Devin

Workspace MCP · stdio · Cloud Agent

Docker / Cloud Container

docker | podman | nerdctl | finch · OCI / Cloud

Gemini CLI

~/.gemini/settings.json · CLI

JetBrains AI / Junie

Settings -> MCP Servers · IDE

Kimi Code

~/.kimi/mcp.json · IDE / CLI

Ollama / Local & OpenRouter

Local stdio MCP + CLI · Local / Router

OpenHands

config.toml [mcp] · Agent

Qwen Code

~/.qwen/settings.json · IDE / CLI

Windsurf

~/.codeium/windsurf/mcp_config.json · IDE

Zed

~/.config/zed/settings.json · IDE