Original Summary

I'm an 18-year-old developer from Georgia. I built a tool (working name: Tripwire) that scans the files AI coding agents obey (.claude/settings.json, .mcp.json, CLAUDE.md , .cursorrules) for dangerous patterns before the agent trusts a repo: hooks that run commands, MCP servers that launch a shell, wildcard permissions, and instructions hidden in invisible Unicode. It runs as a VS Code extension, a CLI, and a GitHub Action that fails a pull request and reads its config from the base branch, so a PR can't suppress its own findings. It's read-only, offline, and rule-based (no AI decides what's dangerous). I scanned 110 public repos that use agent configs: 24 had at least one high-severity pattern (the sample is biased toward repos that already use these files, and I labeled 40 findings myself: 29 clear true positives, 8 low-value, 3 false positives). It can't see malicious code in a repo's own source and it only flags known patterns. I know Snyk's agent-scan, Cisco's scanner, and a few small open-source tools cover parts of this. Two honest questions: does anyone here actually need this, and if you were me, would you try to monetize it (paid audits, a team tier, something else) or just keep it open source? Brutal feedback welcome. Repo: https://github.com/giorgiotskh/tripwire.git   submitted by   /u/giorgiotskh [link]   [comments]

  • 情报分类：商业与市场研究
  • 分类依据：内容涉及商业、投资或市场动态
  • 信息来源：Reddit · SideProject
  • 发布时间：2026/10/19 03:06:43