DavidCarliez/trustmebro

What it solves

TrustMeBro allows red-team testers to bypass LLM guardrails by feeding coding agents fabricated tool outputs. It prevents agents from being blocked by real-world constraints (like missing DNS markers) by simulating the successful output of command-line tools, thereby testing how the agent reacts to deceptive or specific environmental data.

How it works

The project uses "PATH shims" to intercept calls to command-line tools (such as dig, nslookup, or host). When an agent invokes a shimmed command, TrustMeBro evaluates the request against a set of rules to decide whether to:

• Spoof: Return fake or generated output without running the real tool.
• Rewrite: Run the real tool but modify the resulting output.
• Passthrough: Execute the real binary unchanged.
• Reject: Block the call entirely.

On Linux, it offers a "Lab mode" using Bubblewrap to create an interception namespace, ensuring that even calls to absolute paths (e.g., /usr/bin/dig) are intercepted.

Who it’s for

It is designed for security researchers and developers performing controlled red-team testing on AI agents (like Codex or Claude Code) to evaluate their decision-making processes based on tool outputs.

Highlights

• Transparent Interception: Works via PATH shims without requiring plugins, hooks, or MCP integration.
• DNS Specialization: Includes built-in generators for realistic dig, nslookup, and host outputs.
• Flexible Rule Engine: Supports matching based on command names, domains, DNS record types, argument globs, and regular expressions.
• Audit Logging: Records every interception decision in a timestamped JSONL log for analysis.
• Lab Mode: Provides a Linux-based namespace to prevent agents from bypassing shims via absolute paths.