Command line

The malspark command runs the pipeline in a single process, with no API, worker or backing service. It is useful for a quick local run, for scripting and for development. For anything shared, use the stack and the REST API.

uv run malspark --help

Where it reads its settingsCopy Anchor Link

The command line builds the settings model directly. It reads the process environment and a .env file at the project root, not the settings store the console edits. Nested settings use a double underscore:

export LLM__PROVIDER=anthropic
export NEGOTIATION__MAX_ITERATIONS=3

It is the one consumer that works this way. See Configuration.

malspark analyzeCopy Anchor Link

Runs the full pipeline on one sample and prints the verdict.

uv run malspark analyze <sha256> --sample ./sample.dll --report report.md --output bundle.json

The command prints the verdict, the number of debate rounds, whether consensus was reached, a short run summary and the STIX bundle. It exits with code 1 when the pipeline fails.

A run from the command line has no account, so it uses the unscoped memory. There is no isolated_memory option.

A dry run with no model:

uv run malspark analyze sample_1 --mock --name test.exe

malspark infoCopy Anchor Link

Prints the active configuration: the LLM provider, the expert and judge models, the round limit, the token limit, the active team, its analysts and the registered parsers.

malspark create-adminCopy Anchor Link

Creates an admin account, or promotes an existing account to admin, in the API's database. No endpoint grants admin, so this is how the first one is made. Unlike the other commands it works on the stack's database, not on the local settings: it reads DATABASE_URL as the API does and uses the API's own user model and password hashing, so it needs the API package (uv sync --all-packages, or the backend image).

In the compose stack, run it in the API container, which has both:

make create-admin [email protected]
# the same, by hand:
docker compose -f docker/docker-compose.yml exec backend-api malspark create-admin [email protected]

make create-admin reads EMAIL from its own command line only, never from the environment, where git and other tools keep the user's own address.

• No account with that address: one is created with the admin role. Its password is asked for twice on the terminal, hidden. It is never taken from an argument, and it follows the registration's rule of 8 to 128 characters.
• An existing account: it is promoted and keeps its password; nothing is asked. Promoting an account that is already an admin changes nothing and says so. A deactivated account is promoted and stays deactivated, and the command says that it cannot sign in.
• An account whose address differs only in case (Kate@ against kate@): sign-in compares the address exactly, so these are two accounts. The command refuses, says how many there are, and changes nothing; give the stored address exactly.

A creation or a promotion is recorded in the audit log as auth.role.grant, with no actor (the command line is not an account) and the account as its resource. The command refuses, and changes nothing, when the database cannot be reached or does not carry this release's migrations (run make migrate, or let the stack's migrate service finish, first). It exits with code 1 on a refusal.

For a script, write the password to standard input. -T turns off the terminal that docker compose exec allocates:

printf '%s\n' "$ADMIN_PASSWORD" | docker compose -f docker/docker-compose.yml \
  exec -T backend-api malspark create-admin [email protected] --password-stdin

malspark memoryCopy Anchor Link

Inspects and maintains the long-term case memory.

uv run malspark memory stats
uv run malspark memory purge-low-quality --dry-run

purge-low-quality takes:

The same purge is available to an administrator through POST /api/v1/system/ltm/purge.