Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/morwn/github-threat-detector/llms.txt

Use this file to discover all available pages before exploring further.

The analyze command loads all heuristic analyzer modules, queries the events already stored in PostgreSQL by collect, and writes structured findings rows for every anomaly detected. You can scope a run to specific repositories or to a focused subset of rules — useful both for triage and for scheduled pipelines where only certain rule families need to fire.

​
Usage

python cli.py analyze [OPTIONS]

​
Options

​
--repos
string
Comma-separated list of repositories (owner/repo) to analyze. When omitted, every repository present in the database is analyzed. Use this flag to limit scope during an incident investigation or when testing a single rule against a known-good repository.
​
--rules
string
Comma-separated list of rule IDs to run. When omitted, all 17 rules execute. Rule IDs are listed in the reference table below. Passing an unrecognized ID is silently ignored — the filtered list simply contains no match.

​
Examples

Run all rules across all collected repositories: 
python cli.py analyze
Run all rules scoped to a single repository: 
python cli.py analyze --repos aquasecurity/trivy
Run a specific pair of rules across all repositories: 
python cli.py analyze --rules pr-target-abuse,workflow-file-change
Run commit tamper-detection rules on a single repo: 
python cli.py analyze \
  --repos aquasecurity/trivy \
  --rules commit-date-gap,null-committer-email

​
Rule Reference

All 17 built-in rules are listed below. Each row shows the rule ID you pass to --rules, the source module that implements it, and its default severity.
Rule IDAnalyzer ModuleSeverity
workflow-file-changeanalyzers/malicious_ci.pyhigh
pr-target-abuseanalyzers/malicious_ci.pycritical
workflow-run-from-forkanalyzers/malicious_ci.pycritical
release-actor-anomalyanalyzers/release_tamper.pycritical
rapid-releasesanalyzers/release_tamper.pyhigh
new-actor-ci-changeanalyzers/social_eng.pyhigh
member-added-suspiciousanalyzers/social_eng.pymedium
repo-made-publicanalyzers/social_eng.pyhigh
force-push-defaultanalyzers/push_anomaly.pyhigh
rapid-sequential-pushesanalyzers/push_anomaly.pymedium
delete-branch-protectionanalyzers/push_anomaly.pyhigh
fork-spikeanalyzers/fork_bomb.pymedium
issue-prompt-injectionanalyzers/ai_workflow_abuse.pycritical
issue-rapid-closeanalyzers/ai_workflow_abuse.pyhigh
ai-workflow-unsafe-inputanalyzers/ai_workflow_abuse.pycritical
commit-date-gapanalyzers/commit_tamper.pycritical
null-committer-emailanalyzers/commit_tamper.pycritical

​
Notes

  • analyze calls apply_schema() automatically on startup, so it is always safe to run even if init-db has not been called manually.
  • Rules that depend on data collected with optional collect flags will produce no findings if that data is absent. For example, ai-workflow-unsafe-input requires --workflow-files to have been passed to collect, and commit-date-gap requires --commits.
  • Each analyzer’s run() method is exception-safe: if an individual rule errors for a given repository (e.g., missing data), it prints a warning and continues rather than aborting the entire run.
  • Findings are deduplicated by the database layer, so running analyze multiple times on the same data is safe.

Build docs developers (and LLMs) love

Get started for freeTalk to us