Your terminal trusts Unicode blindly. Tirith is the skeptic it needs.

What it does

Tirith hooks into your interactive shell and inspects every command, pasted text, and scanned file before execution. It blocks or warns on homograph URLs, pipe-to-shell patterns, base64 decode-execute chains, credential exfiltration, and invisible Unicode steganography. When input is clean, it adds sub-millisecond overhead and produces zero output; you only notice it when it trips.

The interesting bit

The project treats the terminal as a browser-grade attack surface. It applies defenses browsers have used for years—like mixed-script and confusable detection—to shell commands and AI agent configs, backed by a signed local threat database built from OpenSSF malicious packages, CISA KEV, and abuse.ch feeds.

Key highlights

• 80+ structural detection rules across 15 categories, from ANSI escape injection to post-compromise behavior like /proc/*/mem scraping.
• Signed offline threat intelligence for packages, hostnames, and IPs, with optional live enrichment via OSV.dev and Google Safe Browsing.
• Pre-execution, not runtime sandboxing—it gates commands structurally but explicitly does not contain or monitor a process after launch.
• AI-agent coverage via shell hooks and optional MCP tools, though the README notes this is advisory and depends on the agent actually routing through the hooked shell.
• Cross-platform shell support for zsh, bash, fish, and PowerShell, with a tirith doctor command to diagnose hook health.

Caveats

• Shell hooks can silently degrade. The README admits fragility across shells, prompt frameworks, and history tools, and recommends running tirith doctor to verify the hook is still alive.
• Several features are Unix-only. Daemon mode, tirith run, and tirith fetch are not available on Windows.
• It is a structural gate, not a sandbox. Tirith explicitly disclaims runtime containment, post-execution network monitoring, and malware detonation; a command that clears the gate is on its own.

Verdict

Developers who copy-paste install scripts or run AI-generated shell commands should treat this as essential hygiene. If you already sandbox every process or never pipe remote downloads to an interpreter, you are probably not the target audience.