sheeki03/tirith

What it solves

Tirith is a security gate for the terminal, designed to prevent the execution of malicious commands, obfuscated payloads, and data exfiltration. It addresses the gap where terminals render Unicode and ANSI escapes without question, leaving users vulnerable to homograph attacks (visually similar URLs), pipe-to-shell exploits, and credential theft.

How it works

Tirith intercepts commands, pasted content, and files before they execute. It uses a combination of 244 detection rules across 35 categories—including homograph detection, Base64 decode-execute chains, and credential scanning—and a signed threat intelligence database containing known-malicious packages, IPs, and hostnames. It integrates as a shell hook for interactive shells (zsh, bash, fish) and provides a scanning tool for code files (JS/Python).

Who it’s for

Developers, DevOps engineers, and users of AI agents that run shell commands, who want to prevent accidental execution of untrusted code or the accidental leak of sensitive credentials from their terminal.

Highlights

• Homograph Attack Prevention: Blocks URLs that use Cyrillic or Greek lookalikes to mimic legitimate domains.
• Pipe-to-Shell Guard: Detects and warns against risky patterns like curl | bash or wget | sh.
• Credential Exfiltration Detection: Blocks commands that upload sensitive files (e.g., /etc/passwd) or environment variables to remote servers.
• Threat Intelligence: Uses a signed local database of known-malicious packages and infrastructure from sources like OpenSSF and CISA.
• AI Agent Security: Provides a pre-tool hook to guard commands executed by AI agents.
• Code Scanning: Scans JS and Python files for obfuscated payloads and dynamic code execution.