sheeki03/tirith

What it solves

Tirith is a security gate for the terminal, designed to prevent users and AI agents from executing malicious commands. It addresses the "invisible" threats that terminals typically ignore, such as homograph attacks (where visually similar Unicode characters mimic legitimate URLs), obfuscated payloads, and credential exfiltration attempts.

How it works

Tirith intercepts commands, pasted content, and files before they execute. It uses a combination of 244 detection rules across 35 categories—including homograph detection, pipe-to-shell analysis, and secret detection—and a signed threat intelligence database containing known-malicious packages, IPs, and hostnames to block or warn the user.

Who it’s for

Developers, security researchers, and operators of AI agents who need a pre-execution safety layer to prevent accidental execution of compromised scripts or the exfiltration of sensitive environment variables and keys.

Highlights

• Homograph Defense: Blocks URLs that use Cyrillic or Greek lookalikes to mimic legitimate domains.
• Command Analysis: Detects risky patterns like curl | bash or Base64 decode-execute chains.
• Data Exfiltration Guard: Blocks commands that attempt to upload sensitive files (e.g., /etc/passwd) or environment variables to remote servers.
• AI Agent Safety: Provides hooks for AI agents to prevent them from running destructive or malicious commands.
• Threat Intelligence: Integrates a signed database of known-malicious packages and infrastructure from sources like OpenSSF and CISA.
• File Scanning: Scans Python and JavaScript files for obfuscated payloads and dynamic code execution.