Skip to content

Trustline v0.1.0 — trusted baseline + auto-rollback for AI agent config

Latest
Latest

Choose a tag to compare

View all tags
@LuckTerence LuckTerence released this 02 Sep 14:58
· 10 commits to main since this release
v0.1.0
ac73bbb

Trustline v0.1.0

Trusted baseline + auto-rollback for AI agent configuration files (.claude/, AGENTS.md, .cursorrules, .mcp.json, ...).

Why

AI coding agents load instructions from files inside the repository you are
working in. Cloning an untrusted repo or installing a third-party MCP can
silently plant instructions that exfiltrate secrets, tamper with your shell, or
hide their own actions.

Existing scanners (medusa, Snyk agent-scan, Cisco mcp-scanner) answer "is this
file poisoned?" — and leave the fixing to you. Trustline answers the two
questions that come after:

  1. Did my agent config drift from a state I explicitly trusted? (status)
  2. How do I get back to it? (rollback, with the tampered copy preserved)

Because PreToolUse fires before a write lands, Trustline can also refuse to
let an agent write a poisoned rules file in the first place.

What's in the box

  • init — establish a SHA-256 trusted baseline (optionally with content snapshots)
  • status — diff working tree vs baseline (added / modified / deleted)
  • scan — 15 static heuristic signals (exfiltration, download-exec, privilege,
    persistence, obfuscation, instruction-override, MCP supply chain, ...)
  • rollback — restore from git HEAD or trusted snapshot; soft rollback keeps
    the tampered copy outside the working tree
  • export-sarif — SARIF 2.1.0 for CI / DefectDojo
  • hook install — wire Claude Code hooks (SessionStart / PreToolUse / InstructionsLoaded)
  • per-project audit log: ~/.config/trustline/projects/<root>/audit.jsonl

Real-world smoke scan (2026-09-02)

Repository Managed files Findings Rules
affaan-m/ECC (245k★) 65 3 T010 · T007 · T012
yamadashy/repomix 11 1 T010 (unpinned npx MCP)
Pantheon-Security/medusa 3 2 T013 · T004 (both inside its own tests/fixtures/malicious_repo/)

Findings are static signals that require human review — the point is that the
tool runs cleanly on real trees with low false-positive volume, and that it
flags the very samples medusa ships as malicious.

Verified in real Claude Code sessions (v2.1.220)

  • SessionStart warns on any managed file that differs from the baseline ✅
  • PreToolUse on Write/Edit/NotebookEdit inspects the incoming
    content and blocks with exit 2 on high-severity signals ✅
  • InstructionsLoaded is best-effort: the event is not emitted in all Claude
    Code versions / headless mode — treat it as defense-in-depth, not the primary gate

Install

pip install trustline

Known limitations

  • Static heuristics only: a hit is a signal to review, not a verdict.
  • First release ships Claude Code hooks only (Cursor / Codex adapters planned).
  • No fleet / central management yet (that's the planned Pro layer).

Roadmap (next)

  • consume medusa / mcp-scan SARIF as an additional detection source
  • Cursor & Codex adapters
  • fleet baseline distribution + compliance export
Assets 4
Loading