tirith

Why we included this project

Most security tools guard the browser, but the terminal is still wide open. Tirith sits in your shell and checks each command and pasted snippet before it runs, catching homograph URLs that swap Latin letters for Cyrillic look-alikes, pipe-to-bash installers, and ANSI escape tricks. It also flags payloads that quietly try to exfiltrate credentials, and it does all this against a signed threat database that works offline, so there's no network call and no telemetry. For developers who routinely curl scripts and for teams running AI agents that execute shell commands, this is a practical layer of defense that doesn't slow anyone down. It supports bash, zsh, fish, and PowerShell, and once it's in your shell profile you can forget it's there until it stops something.