A small tool with one job.
Tripcord checks the files that tell AI coding agents what to run, before the agent runs it.
How it is built
Read, do not run
Inspecting a repository must never trigger what is in it. The scanner reads files as text and does not execute, import or install anything.
Deterministic
Fixed rules, not a model. The same input gives the same findings, and each finding names its rule so you can argue with it.
Never change files silently
Files change only when you approve a fix or run a command that says it writes.
Who makes it
Built by Giorgi, an independent developer in Georgia. It is an early product, currently version 0.1.0, with a CLI, a GitHub Action, a git hook and a VS Code extension that share one scanning core.
It has not had an independent security review. The test results and known gaps are listed in the open on the home page.
Found a false positive, or want a rule?
Tell us the file and the finding. Reports like that are how the rules improve.