Short answers. The other pages have the detail.
One host. MARS is a single service with a built-in database, so there is no separate database server or message broker to operate. The link sandbox is optional and runs in containers.
Microsoft 365 mail for the reporting mailbox, Defender XDR for incidents, Defender for Endpoint for device and email activity, and Entra ID for account context. You can also use MARS on uploaded message files alone.
With offline packages, so the host does not need internet access. Each package is verified, applied as a dry run first, and preceded by a backup.
No. MARS is designed as a single instance for one security team.
Anthropic, OpenAI and Gemini models, local models through Ollama or another local runtime, and OpenAI-compatible company gateways. Mail, XDR incidents, sandbox results and the analyst assistant can each use a different one.
Yes. Point it at a local model or at a gateway inside your network. The host sets which endpoints MARS may reach.
The evidence MARS gathered for the case: header and body text, links, and the findings of its own checks. Internal mailboxes and account names can be replaced with pseudonyms before sending.
MARS is designed so that it should not. Attacker text is passed as marked evidence, the reply must fit a fixed format, and a conclusion that cites evidence MARS never collected is rejected. No defence here is absolute, which is why a person approves every action.
An answer without evidence behind it is held for review instead of published. Analysts can overrule a verdict and record why, and known cases can be replayed to compare quality before a change to the model or its instructions is released.
No. It proposes response steps. A person approves them, and MARS then checks the outcome in the external system.
Traditional Chinese and English. AI output is produced in English and translated into Traditional Chinese in the background.
MARS is free software under the GNU AGPL, version 3 or later. You pay for your own host and for the AI provider and threat-intelligence services you choose to connect.
You may run MARS, read its source, change it and pass it on, for any purpose and at no charge. The licence comes with no warranty.
If you run a modified MARS for people who use it over a network, section 13 of the licence requires you to offer those people the source of your modified version. If you distribute MARS, changed or not, it stays under the same licence. Running MARS unmodified adds no publishing duty.
No. The licence covers the program. Your configuration, the mail MARS analyses and the records it keeps are yours and are not source code. Code is different: if you change the program, or add code that becomes part of it, you have a modified version and the answer above applies.
MARS depends on components with their own copyleft licences, among them PyMuPDF (AGPL-3.0) and extract-msg and pcodedmp (GPL-3.0). The dependency list in the repository names all of them.
No. It is a summary. The licence text is what binds, so read it, and ask your own counsel if the terms matter to a decision.