Developers & contributors

AI Malware Guardian is a local-first Windows desktop tool. Detection runs on your machine with ETW telemetry, behavioral baselines, and shipped ONNX models. This site handles accounts and installer distribution only.

Download for Windows Technical deep dive

License

The open-source edition is released under GNU AGPL-3.0. You may study, modify, and redistribute source under the license terms. Network use may require offering corresponding source to users.

Legal hub · Full license text

Architecture (high level)

Two-process desktop app: elevated monitor (Rust + ETW) and Tauri UI (Vite + TypeScript). Scoring stays on-device.

Rust Tauri 2 ETW ONNX TypeScript

Build prerequisites

Typical Windows dev environment:

  • Rust toolchain (stable) + Cargo
  • Node.js LTS (Tauri / Vite UI)
  • Visual Studio Build Tools / Windows SDK
  • Python 3 (ML training scripts — optional for runtime)

Repository access

The public GitHub repository will be linked at open-source launch. Until then, email support@aimalwareguardian.com for early contributor access or security coordination.

Security disclosure

Report vulnerabilities privately to support@aimalwareguardian.com. Do not file public issues for exploitable bugs before coordinated disclosure.

Help wanted (draft roadmap)

Placeholder list while we finish the OSS transition. Priorities will tighten after the first public release. Not every item is open for external PRs yet — check back when the repo is public.

Good first issue

False positive reports & documentation

Structured repro templates (process, path, tier, baseline age), install troubleshooting, and SmartScreen / Defender coexistence guides. Low-risk docs and issue hygiene.

Good first issue

Allowlist & placement rules

Vendor install roots, Microsoft Store apps, and common game launchers — data-driven path/signer heuristics with tests. Helps reduce noise without weakening detection.

Medium — review required

Windows version matrix

Test notes across Windows 11 builds (and Win10 22H2 where supported). ETW provider availability and installer edge cases on clean VMs.

Medium — review required

Respond wizard copy & UX

Guided remediation text for high-tier alerts (no automatic quarantine in OSS). Clear, accessible steps that point users to Windows Security and their own tools.

Medium — review required

ONNX / Layer 1b threshold work

Model and baseline improvements using real ETW corpora — requires maintainer review, integration tests, and synchronized model_meta.json updates.

Future direction

Resource anomaly channel (Tier 3)

Research and instrumentation for sustained CPU/GPU/NPU spikes vs per-machine baselines — north-star detection for embedded malicious mini-models. Not scheduled for v1 OSS.

Future direction

Corpus contributions

Anonymized benign ETW CSV snippets for training — with clear consent and scrubbing guidelines. Creative rule packs as data (JSON/YAML) if we add a loader.

Maintainer only

Core monitor pipeline & crypto

ETW architecture, license/API surfaces, and anything that reintroduces block/quarantine automation stays with the maintainer until the threat model and legal posture are explicit.

Where we are headed

High-level direction for contributors — details will land in CONTRIBUTING.md when GitHub goes public.

OSS-first builds

Default public profile: no license gate, no quarantine vault, Respond guidance instead of automatic blocking.

Local-first privacy

Scoring on-device; website is for accounts and gated installer download — not behavioral telemetry upload.

Community quality bar

CLA on merge, one logical change per PR, tests green, no secrets in tree. We will not promise every PR lands.