Getting Started

marshmallow/mr-mallow is a single-purpose attribution package: it injects a Marshmallow signature (an HTML comment and/or a small badge markup) into the rendered HTML of a Laravel site so anyone viewing source can see who built it.

Install it via Composer:

composer require marshmallow/mr-mallow

Then verify it is actually doing anything. Three places to look first, in order:

vendor/marshmallow/mr-mallow/src/MrMallowServiceProvider.php — check whether boot() registers a middleware, a Blade directive (Blade::directive('marshmallow', ...)), or both. Laravel package auto-discovery means you usually will not need to touch config/app.php.
vendor/marshmallow/mr-mallow/config/ — if a config file exists, publish it with php artisan vendor:publish --tag=mrmallow-config and read the keys to know what is toggleable per environment.
vendor/marshmallow/mr-mallow/README.md — for a package this small the README usually IS the API reference. Read it before wiring anything up by hand.

Your first use case should be the simplest possible verification: run php artisan serve, hit any route in a browser, and View Source → Cmd/Ctrl+F "marshmallow". If the signature is not there, the auto-registered middleware is either not firing or is gated behind an environment check. That single curl tells you more than the docs:

curl -s https://your-app.test | grep -i mallow

Implementation Patterns

Pattern 1: Global middleware (default path)

Most likely the package ships a middleware that appends to $response->getContent(). If auto-discovery does not kick in (e.g. you disabled discovery or you are on an older skeleton), register it manually.

Laravel 11/12 (bootstrap/app.php):

->withMiddleware(function (Middleware $middleware) {
    $middleware->append(\Marshmallow\MrMallow\Http\Middleware\InjectSignature::class);
})

Laravel 10 and earlier (app/Http/Kernel.php), add to the web array:

protected $middlewareGroups = [
    'web' => [
        // ...
        \Marshmallow\MrMallow\Http\Middleware\InjectSignature::class,
    ],
];

Registering it on the web group rather than globally is usually the right call — you do not want an HTML comment appended to JSON API responses or to file downloads.

Pattern 2: Route-scoped application

If the middleware is not global, attach it per-route for the marketing site only:

Route::middleware(['web', 'mrmallow'])->group(function () {
    Route::get('/', HomeController::class);
    Route::get('/about', AboutController::class);
});

This keeps admin panels, Horizon, Telescope, and API routes free of the comment.

Pattern 3: Explicit Blade inclusion

If the package exposes a Blade directive or partial, embed it in your layout instead of relying on middleware:

{{-- resources/views/layouts/app.blade.php --}}
<html>
    <head>...</head>
    <body>
        @yield('content')
    </body>
</html>
@marshmallow

Or, if it ships a view:

@include('mr-mallow::signature')

This is the most predictable integration — it is explicit, greppable, and does not depend on middleware ordering.

Pattern 4: Environment gating

You almost certainly do not want the signature on local test URLs or in CI snapshot tests. Gate it:

// config/mrmallow.php (published)
return [
    'enabled' => env('MR_MALLOW_ENABLED', app()->isProduction()),
    'comment' => 'Crafted with care by Marshmallow 🏮 https://marshmallow.dev',
];

…or wrap the Blade include:

@env('production')
    @marshmallow
@endenv

Pattern 5: Combined with response caching

If you use a full-page cache (spatie/laravel-responsecache, Cloudflare, etc.), the signature becomes part of the cached body. That is fine in production, but be aware that in development the cached HTML will retain whatever signature was rendered at cache time. Flush the cache after toggling MR_MALLOW_ENABLED.

Gotchas and Tips

Content-Length breaks silently. Any middleware that mutates getContent() must drop the Content-Length header or the browser may truncate the response. If the package handles this, good — if not, do it yourself in a $response->headers->remove('Content-Length') call in a wrapping middleware.
Streamed responses cannot be mutated. StreamedResponse and BinaryFileResponse bodies are not strings; middleware that blindly calls $response->getContent() on them will either error or silently produce nothing. Scope the middleware to web routes so file downloads are not affected.
HTML minifiers strip comments. If you run a minifier (spatie/laravel-html-minifier, Vite's HTML plugin, or an edge/CDN transform), the injected  comment may be removed before it reaches the user. Prefer the badge markup over the comment when minification is in the chain.
Comments are visible but not indexed. Do not expect this to help SEO — it is attribution, not metadata. If you actually need branding for crawlers, use a <meta name="generator"> tag or a rel="author" link instead.
Config cache must be cleared. After editing config/mrmallow.php, run php artisan config:clear. env() calls inside config files return null once cached — this is the classic Laravel 11 footgun and it will silently disable the package.
Testing: assert on the response body rather than parsing HTML —
```
$response = $this->get('/');
$response->assertSee('Marshmallow', false); // false = do not escape, so comments match
```
If the signature is injected by middleware, use assertSee with escape: false; standard assertSee HTML-escapes, which strips the  delimiters from your search string.
Blade directive naming collisions. If the package registers @marshmallow, make sure no application-level directive with the same name exists. Laravel silently lets later registrations win, so a stray Blade::directive('marshmallow', ...) in your AppServiceProvider can shadow the package.
Maintenance risk. The repo has zero stars and zero dependents — treat the API surface as unversioned. Pin the version in composer.json ("marshmallow/mr-mallow": "^1.0"), and be prepared to inline the middleware into your own app/Http/Middleware/ if the package stops being updated. It is a ~15-line middleware; the lock-in cost is negligible.
Extension point. If the package ships a mr-mallow::signature view, publish the views (php artisan vendor:publish --tag=mrmallow-views) and edit the markup directly rather than forking. That keeps attribution text, logo, and link URL configurable from your own repo.

Mr Mallow Laravel Package