What Tripcord checks
24 rules run by default. 37 more are opt-in because they are newer or noisier. Every finding names its rule, the file and the line.
Files it reads
Found by name and location. Each is read as text; nothing is run.
CLAUDE.md, AGENTS.md, GEMINI.md.cursorrules and .cursor/rules.claude/settings.json, commands, agents and skillsPlugins a repository ships (.claude-plugin).mcp.json and other MCP server configs.codex/config.toml.gemini/settings.json.github/copilot-instructions.md and .github/instructions.windsurfrules and .windsurf/rules.vscode/tasks.json
Scripts that a hook, task or MCP launch command points at are read too, and scored for network calls, credential paths, pipe-to-shell and decode-and-run.
Rules on by default
Run on every scan, with no flag.
| Rule | What it flags |
|---|---|
AG-001 | Permission widening or bypass |
AG-002 | Command that runs automatically from agent settings |
AG-003 | Project MCP servers auto-approved by project settings |
AG-004 | Local agent settings file is tracked by git |
AG-005 | Environment override redirects credentials or injects code |
AG-006 | MCP server launched through a shell or inline interpreter |
AG-007 | MCP server runs an unpinned package |
AG-008 | Hardcoded secret |
AG-009 | MCP remote server over plain HTTP |
AG-010 | MCP server with overbroad filesystem or command access |
AG-011 | MCP server uses a known-bad or known-vulnerable package |
AG-013 | MCP server launches a repo script with risky behaviour |
AG-014 | Package registry or index redirected |
AG-020 | Hidden Unicode characters |
AG-021 | Exfiltration instruction |
AG-022 | Silence or override instruction |
AG-023 | Agent-config self-propagation |
AG-025 | Skill or subagent requests unrestricted tools |
AG-030 | VS Code task runs automatically on folder open |
AG-110 | Project settings weaken the Bash sandbox |
AG-111 | Hook approves tool calls without asking |
AG-114 | Allow rule for a command that runs other commands |
AG-117 | MCP server marked trusted: tool confirmations are skipped |
AG-118 | Codex configuration removes the sandbox or runs a notify command |
Opt-in rules
Turn them on with --experimental, or enableExperimentalRules in the repository config. They need a license.
| Rule | What it flags |
|---|---|
AG-024 | Encoded or hidden content in an instruction file |
AG-100 | Persona, system-prompt or priority override |
AG-101 | Non-English instruction override |
AG-102 | Tool-poisoning markers in instructions or MCP descriptions |
AG-103 | Encoded instruction the agent is told to decode and follow |
AG-104 | Imperative text hidden by markup |
AG-105 | Look-alike letters from another alphabet in a word |
AG-106 | Keyword spelled out letter by letter |
AG-107 | Instruction to put secrets or conversation data into a URL or a public place |
AG-108 | Instruction file tells the agent to run a script fetched from the network |
AG-109 | Instruction to add an external script to generated code |
AG-112 | Project settings register a plugin marketplace |
AG-113 | Environment variable injects code or weakens TLS (MCP env, or agent env AG-005 skips) |
AG-115 | Allow rule lets the agent edit its own configuration or shell startup files |
AG-116 | Additional directories give the agent access outside the project |
AG-120 | MCP package name imitates a well-known MCP package |
AG-121 | MCP container runs with host access or an unpinned image |
AG-122 | MCP server launched with broad Deno permissions |
AG-123 | mcp-remote bridge to a plain-HTTP server |
AG-124 | MCP server command is a download or proxy-execution tool |
AG-125 | MCP tooling pinned to a version with a published RCE |
AG-126 | Filesystem MCP server rooted at credentials or system directories |
AG-127 | MCP server code is fetched from a URL at launch |
AG-128 | MCP headersHelper runs a risky command when the server connects |
AG-130 | Auto-run command installs a package from a remote or unpinned source |
AG-131 | Auto-run command runs remote content through a Windows system binary |
AG-132 | Auto-run command plants persistence, destroys data or weakens the machine |
AG-133 | Auto-run command starts a container with host access |
AG-134 | Folder-open task reaches a risky task through dependsOn |
AG-135 | Auto-run command sends data out in a DNS lookup |
AG-136 | Auto-run command hides its command name with shell expansion |
AG-137 | Instruction file tells the agent to install from outside the registry |
AG-138 | Instruction file tries to lower the agent's own guard |
AG-139 | Instruction file impersonates the harness, pulls in remote rules or extends itself |
AG-140 | Instruction describes an outbound shell session without naming a command |
AG-141 | Instruction-like prose inside a structured config file |
AG-142 | Text pushed out of view with whitespace |
Output and modes
Findings print as readable text. For tools, write JSON or SARIF 2.1.0 with --json and --sarif. Exit code 0 means clean, 1 means findings at or above the threshold (high by default), 2 means a tool error.
diff compares two git revisions and reports only what the change introduced or made worse. Its configuration and baselines come from the base revision, so a pull request cannot excuse itself.
lock and verify hash MCP server and hook definitions and report drift. baseline accepts current findings. report ties findings to the commit that added them, with a monthly trend. harden prints a safer settings template.
$ tripcord scan .$ tripcord scan . --sarif results.sarif$ tripcord diff origin/main HEAD --fail-on high$ tripcord lock . && tripcord verify .$ tripcord baseline create .$ tripcord report . --format html --out report.htmlRules match known patterns. They do not read your application code, and a finding is a pattern match, not proof of intent. See what it does not do.