# How Matlock Works in Practice (2-Minute Setup) — Matlock

> Matlock — Agent & Developer Tools. Efficient. Exact. By the book. Point Matlock at any project folder for < 50ms AST, MITRE CWE, IEEE Std 1003.1 POSIX, CISA SSDF, and AICPA SOC 2 TSC verification, Safeguard test protection, Cold Box sandboxes, and GitHub Action PR provenance.

- [Appliance Manual](https://matlock.dutchp2p.com/en/manual): Operator and AI navigation manual for Matlock: < 50ms local AST & Pre-CI Command Center, 27-tool stdio MCP server, Safeguard test protection, Cold Box sandboxes, 5-scope ignores, and offline licensing (0 cloud uploads, 0 git-commit blocking).
- [Command Center](https://matlock.dutchp2p.com/en/app): Matlock — Agent & Developer Tools. Efficient. Exact. By the book. Local in-browser Command Center preview (< 50ms WebAssembly AST, MITRE CWE, POSIX & Pre-CI scan, run-line script builder, local SMTP alert setup, and stdio MCP config).
- [Official GitHub](https://github.com/Dutchp2p/matlock-public) · GitHub Action `Dutchp2p/matlock-public@v1` · Badge `https://matlock.dutchp2p.com/badge/verified.svg`
- [Support Box](https://matlock.dutchp2p.com/en/contact/): Skip email queues and spam filters. Send a question, bug report, or billing note straight into our private support queue with zero account signup.

## 01 · Run a Sub-50ms Local Source & Pre-CI Scan

Select any local project folder via Browse (or drop it into the Browser WASM scanner) and run Matlock. Matlock scans your source tree directly in local memory in milliseconds — surfacing untested Dark Code files, oversized monolithic modules, exposed secrets (exact relative folder/file:line shown free on Code Health Reports, never secret values), and standards-anchored pre-commit checks with 0 bytes sent to Matlock. Matlock evaluates technical codebase and pipeline controls against MITRE CWE, CISA SSDF, IEEE Std 1003.1 POSIX, automated Pre-CI integrity gates, and AICPA SOC 2 Trust Services Criteria technical controls (technical controls only; not a CPA certification).

## 02 · 27-Tool Local & Cloud Headless MCP (Settings -> AI Agent (MCP))

Matlock only reads your project by default (if you turn on Restore in Settings, it restores a recorded test only after you approve a line-by-line preview). Follow Top Point Bounties, click Copy Agent Prompt, or open Settings -> AI Agent (MCP) to switch on MCP Server (stdio) and optional Agent Email Bridge (or launch matlock-mcp --stdio --headless in Linux, macOS arm64, Windows, or cloud containers) across Kimi Code CLI, Qwen Code, DeepSeek, Antigravity, VS Code, Visual Studio, Cursor, Windsurf, Cline, Claude Code, Gemini, Copilot, Android Studio, IntelliJ, Ollama, vLLM, SGLang, or LM Studio. Assistants can run "), launch non-blocking runs with async: true (auto-waking on finish or polling compact capsules via matlock_get_action_status), and halt active runs via stop_sequence (matlock_stop_action). Press ? or F1 in the app, call matlock_read_appliance_manual (0 credits), or share /en/manual.md with any chat AI.

## 03 · Action Cards, Save Points, Email Alerts & PR Provenance Badge

Click Matlock in the left rail to run Clean -> Get -> Format -> Lint -> Analyze/Build -> Test with coverage in one unified pass, use the always-open docked Terminal and CLI bar (Save as Card and Chain / Alert), or program Action Cards and 20-step Sequences for USB / external drive save points (robocopy   /MIR /MT:16 on Windows; rsync -a --delete / / on Linux/GoogleBook), cloud object storage (rclone / AWS S3 / Cloudflare R2 / GCS / Azure Blob), and GitHub push (git push origin main gated by physical Approve & Run human approval on Desktop). Open Settings -> Email Alerts to configure outbound-only Native TLS 1.2/1.3 SMTP using global presets (Gmail / Workspace, Microsoft 365 / Outlook, iCloud, Yahoo, Zoho, QQ / 163 Authorization Code, Fastmail, GMX / Web.de, or local Proton Mail Bridge 127.0.0.1:1025) with App Passwords sealed in your OS keychain/vault, choosing per-step on-error (stop_and_alert / continue_and_alert) or unconditional completion (always / send_alert) triggers. In CI/CD Pull Requests, run Dutchp2p/matlock-public@v1 and cite https://matlock.dutchp2p.com/badge/verified.svg.

## 04 · Safeguard Rules & Pipelines from AI Tampering

Every Custom Test, Action, Walk-Away Sequence, and Alert defaults to Safeguarded (Read & Run Only), sealed locally in your OS user profile outside the repository (Windows DPAPI + Linux 0600 HMAC-SHA256). Your AI assistant can execute tests and read diagnostics freely, while any unauthorized attempt to edit or weaken a Safeguarded check is immediately detected and held for 1-click restore.

Verified baseline skip (<105ms) + Safeguard & clean-room anomaly latch.

## 05 · Activate Pro Offline with No Account or Email

Matlock Pro ($24.99 USD/year flat, zero auto-renewal) requires no user account or password. Complete checkout via Pay by Card (MoonPay & Transak), guided PayPal PYUSD transfer (using your existing PayPal balance or debit card), or 1-click Web3 USD stablecoins (Solana USDC, Base USDC, or Polygon USDC): your contiguous 24-character Activation Key (for example, i34324h32HNbN4u9Kp7xYz8Q—double-click to copy) appears immediately on screen with an unlisted /receipt/ record and an optional one-time receipt email from matlock@dutchp2p.com (0-second persistent email storage). Paste the token into Settings -> License -> Activate in the desktop app once to bind a cryptographically signed offline license to your device, including 1 self-service PC transfer per year.

## Three Deployment Realities. One Deterministic Engine.

- **Cloud VMs & Long-Horizon Agent Sandboxes**: Cloud sandboxes solve execution isolation, not code correctness. A cloud VM stops an agent from wrecking a developer's laptop — not from leaking secrets into a PR, weakening tests to pass a milestone, or burning $500 in tokens re-reading its own mistakes over a 12-hour run. Matlock becomes the deterministic governor inside the container. Because Matlock runs headless, zero-knowledge, and returns compact CWE/POSIX coordinates in under 300 tokens, it acts as the lightweight guardrail that keeps long-horizon cloud agents honest and cheap to run — whether they are spinning inside AWS, Google Cloud, Cloudflare, Azure, Docker, or a local workstation.
- **IDE MCP & Autonomous M2M Agent Pipelines**: Stacking reviewer LLMs on top of coder LLMs burns 15,000–40,000 tokens per pass and still misses cross-file leaks and races. Matlock Pro ($24.99 USD/yr with unlimited $0.00/run MATLOCK_LICENSE_KEY headless runs and Sync with Headless) offloads AST, MITRE CWE, IEEE POSIX.1, Flutter 3.50, TLS, and Cold Box race checks to < 50 ms native code with exact file:line:col diffs and 2-tier loop breakers.
- **Solo Developers, Vibe Coders & Engineering Leads**: When agents write thousands of lines in an afternoon, developers shouldn't retype terminal commands, worry about leaked keys on git push, or guess on AICPA SOC 2 TSC or HIPAA technical readiness. Desktop Safeguard blocks silent test weakening, Sync with Headless shares cards two-way, and 1-push USB/Cloud/GitHub routines run with private outbound-only SMTP email alerts and 0 bytes sent externally.

## What AI Dark Code Looks Like, Why It Hurts, and How Matlock Catches It

- **1. Untested Dark Code & Silent Error Suppression —**: AI generates new production services with zero corresponding unit tests, silent error suppression (CWE-391), and unclosed async timers or streams (CWE-401). — Silent data loss, frozen UI frames, background memory leaks, and regressions nobody notices until customers hit them in production. — Matlock Local Audit cross-references every production file against your test suite and flags silent error suppression and unclosed async handles in compliance with CISA/MITRE CWE benchmarks.
- **2. 250+ Line God-Objects & // ignore Bypasses —**: Agents pack 500+ lines of mixed responsibilities into one file, leave unfinished TODO stubs, or add // ignore: comments to silence standard linters. — Comprehension debt skyrockets, follow-up AI edits break unrelated features, and unfinished stubs trigger automated App Store or Microsoft Store rejections. — Enforces the 250-line compactness ceiling (CWE-1080), ignores inline suppression comments completely, and ranks modular split bounties with 1-click prompts.
- **3. Cross-OS CI Traps & Leaked Credentials —**: Cross-platform POSIX path faults that pass on Windows NTFS, CRLF shell scripts, untracked local imports, lockfile drift, or exposed API credentials (CWE-798). — Linux GitHub Actions pipelines fail 10 minutes after push, or public repo scrapers harvest exposed keys within seconds of a commit. — Standalone Pre-CI gates enforce IEEE POSIX portability specifications, CISA SSDF benchmarks, and automated Pre-CI integrity checks locally before git push ever runs.

## Download Matlock for Windows, Linux & GoogleBook

- **Windows 10 & Windows 11 (x64)**: Distributed exclusively through the official Microsoft Store (App ID: 9P5VNWVWLM4N). Signed by Microsoft with automatic background updates and zero SmartScreen warnings.
- **Linux Desktop & GoogleBook (.deb & AppImage)**: Native GTK3 Flutter desktop binary packaged as zero-FUSE matlock-linux-x64.deb (Ubuntu 22.04+, Debian 12+, and GoogleBook Linux) and portable matlock-linux-x64.AppImage (Fedora, Arch, Ubuntu, Debian). ([AppImage](https://matlock.dutchp2p.com/download/linux) · [.deb GoogleBook/Debian](https://matlock.dutchp2p.com/download/googlebook) · [SHA256SUMS](https://matlock.dutchp2p.com/download/SHA256SUMS)) — `chmod +x matlock-linux-x64.AppImage && ./matlock-linux-x64.AppImage` | `sudo apt install ./matlock-linux-x64.deb`
- **How to Activate or Move Your Matlock Pro License**: When you click "Upgrade" inside the Matlock desktop app or visit /en/pricing, a unique contiguous 24-character license key (e.g., i34324h32HNbN4u9Kp7xYz8Q — zero hyphens so double-clicking selects the entire key at once) is generated for your checkout session. Copy and save this key. Matlock saves a cryptographically signed offline license in private local user-profile storage outside your repository, sealed locally on your computer and verified 100% offline on every start with zero phone-home calls.
- **2-Line Container & MicroVM Quick-Launch**: Vendor-agnostic headless bootstrap for Cloudflare ContainerHarness / Codex cloudflare/debian-trixie, Docker, E2B, and Firecracker (SHA-256 verified):

```sh
curl -sSfLO https://matlock.dutchp2p.com/agent-install.sh && curl -sSfLO https://matlock.dutchp2p.com/agent-install.sh.sha256 && (sha256sum -c agent-install.sh.sha256 2>/dev/null || shasum -a 256 -c agent-install.sh.sha256) && sh ./agent-install.sh
export PATH="$HOME/.local/bin:$PATH" && matlock-mcp --stdio --headless --no-coverage
```

## Frequently Asked Questions

### How do I know if my AI-generated code is ready for production?

Run Matlock before every commit or release. In under 50 ms locally or inside your container, Matlock checks ASTs against MITRE CWE, IEEE POSIX.1, CISA SSDF, and 250-line modularity, then runs your compiler and tests in a multi-threaded Cold Box sandbox.

### How do I stop coding agents from weakening or skipping tests just to pass?

Matlock Safeguard stores a tamper-evident baseline of verified unit tests in OS storage outside your repository, where inline ignore comments do nothing. If an agent removes, skips, or softens an assertion, Matlock flags it immediately and can restore the original test.

### How can I cut my AI coding token and compute bill without stacking agents on top of agents?

Having a second LLM review multi-file edits burns 15,000–40,000 context tokens per pass. Matlock offloads deterministic AST, CWE, and POSIX checks to native code via MCP (matlock_run_scan), returning deduplicated file:line:col coordinates and 5-line repair diffs in under 300 tokens (up to 95%+ reduction).

### How do I catch leaked API keys, CWE security bugs, and Linux CI failures before git push?

Run a free in-browser WebAssembly scan on this page (showing exposed secret file:line locations free) or run the Matlock desktop app locally. Matlock catches hardcoded keys (CWE-798), injection sinks, CRLF shell traps, lockfile drift, and Windows-to-Linux path breaks before git push.

### Can Matlock be used for HIPAA or AICPA SOC 2 sensitive projects and inside AWS, Google Cloud, or Cloudflare containers?

Yes — 0 bytes of source code are ever sent to Matlock, and MATLOCK_OFFLINE=1 enforces strict air-gap mode inside your workstation or AWS, Google Cloud, Cloudflare, Azure, or Docker container. Matlock evaluates technical code controls mapped to MITRE CWE, CISA SSDF, AICPA SOC 2 TSC, and HIPAA Security Rule (45 CFR 164.312) technical safeguards (technical controls only, not CPA or legal certification).

### Which programming languages, operating systems, IDEs, and AI models work with Matlock?

Matlock verifies 10 ecosystems (Dart/Flutter, TypeScript/JS/Node, Python, Rust, Go, Java/Kotlin, C/C++, C#/.NET, SQL, and Shell/YAML/Docker) targeting any OS. Its 27-tool MCP server connects Claude, Gemini, Codex, Cursor, Copilot, Kimi, Qwen, DeepSeek, GLM, Windsurf, Cline, VS Code, JetBrains, and Ollama across Windows 10/11, Linux, GoogleBook, and headless macOS Apple Silicon.