Tirith is an open-source, sub-millisecond security runtime and policy-as-code engine engineered to protect developer environments and AI coding agents from malicious, destructive, or unintended shell command executions. Positioned as a real-time terminal guard, Tirith intercepts command-line invocations before they reach the underlying operating system shell, analyzing command strings, arguments, network targets, and file operations against declarative security rules and heuristic threat signatures.
The engine provides defense-in-depth against common command injection and supply-chain vectors prevalent in automated AI workflows. Key detection modules include blocking homograph attacks that disguise malicious URLs using Unicode lookalikes, intercepting pipe-to-shell patterns (such as curl-or-wget-to-bash execution), preventing unauthorized modifications to sensitive configuration files and dotfiles, sanitizing ANSI escape sequence injections that attempt terminal spoofing, and alerting on unencrypted network transport.
Tirith integrates into existing developer workflows through three primary surfaces: an interactive CLI scanner for ad-hoc script and command evaluation, shell hooks (supporting Zsh, Bash, and Fish) for continuous developer terminal protection, and a dedicated Model Context Protocol (MCP) server designed for autonomous AI agents like Claude Code, Cursor, and Hermes. When integrated via MCP, AI agents can validate proposed shell commands against Tirith policies before dispatching tool calls, ensuring agentic operations adhere strictly to local security constraints.
Operating entirely on-device with zero network telemetry or cloud dependencies, Tirith evaluates custom YAML-based policy files to enforce team-wide or repository-specific execution boundaries. The software is distributed under a dual-licensing structure, offering a free open-source AGPL-3.0 license for community use alongside commercial licensing for proprietary enterprise deployments. Deployment requires no external infrastructure beyond the local CLI runtime, making it easily embeddable in CI/CD pipelines, container environments, and developer workstations.
