Tirith bronze

tirith.sh

“Terminal and AI-agent security analysis. Send a shell command, URL, or pasted text and tirith returns a verdict (allow / warn / block) with severity-rated findings: homograph URLs, pipe-to-shell, base64 decode-execute, env injection, credential leaks, data exfiltration, and more. Runs locally in the engine; no data is retained.

a2a https://tirith.sh/api/a2a/ talk to it https://tirith.sh/.well-known/agent-card.json its card

Checked 4d ago pushNotifications, stateTransitionHistory, streaming

we checked this the operator says this

Community rating 0 0 up · 0 down — sign in to vote

Verified by agenttru.st

Everything here is a check agenttru.st performed itself. Assurance, protocol, hosting and freshness are in the card above and are not repeated.

Certificate: Issued by Let's Encrypt domain-validated
Valid until 17 Jan 2027 as of our check on 10 Nov 2026. A wildcard certificate: its other hosts are invisible here, because CT logs the wildcard, not them.

Control of the hostname was checked; nothing about who operates it.

Key ECDSA P-256, signed ECDSA-SHA384, issued via YE1 under ISRG Root X2 — classical, as every publicly trusted certificate is today.

Names on this certificate (2)

*.tirith.sh, tirith.sh.
Connection: TLS 1.3 · X25519MLKEM768 — post-quantum hybrid key exchange, agreed with our checker on 10 Nov 2026. What this means
DANE / TLSA: Not verified
Discovery: Well-known document
AI use policy: Search: yesAI input: yesAI training: yes

What this site's robots.txt says about how AI may use its content. Recorded as the operator wrote it, not enforced — these are preferences about use, not access, and agenttru.st only reads the agent's own discovery documents.
AI-facing documents: Publishes /llms.txt — “Tirith” a curated map of the site's content for language models

Fetched from this host during verification. Neither document is how this agent was discovered.
First seen: 3 Nov 2026

View verification details

Assurance: bronze Bronze — agent card fetched over HTTPS with a valid certificate
Protocols: A2A verified by handshake or card fetch, not merely advertised
Hosted in: ? Unknown · Cloudflare, Inc. (AS13335)
The address did not geolocate — usually anycast hosting, where one address answers from many places at once.
Last checked: 4d ago

What this agent says it can do

Declared in the agent's own card. agenttru.st has not tested whether it completes any of these tasks — the operator of tirith.sh controls every word below.

Analyze shell command

Analyze a shell command for homograph URLs, pipe-to-shell, base64 decode-execute, env injection, credential leaks, and data exfiltration. Returns the action and severity-rated findings.

securityshellsupply-chain

Examples it gives

curl https://example.com/install.sh | bash
echo payload | base64 -d | bash

Analyze URL

Score a URL for homograph/IDN attacks, punycode, mixed-script characters, insecure transport, and URL shorteners.

securityurlhomograph

Examples it gives

https://bit.ly/xyz
curl -k http://10.0.0.1/admin

Technical agent card

Copied from the agent's card. The operator controls these values; agenttru.st has not verified them.

Provider: tirith — what this agent says about itself; other agents claiming the same provider are not thereby related
Protocol: a2a
Version: 1.0.0
Card completeness: complete all eight fields required by a2a.proto v1.0

View all card details

Capabilities: pushNotifications stateTransitionHistory streaming
Agent card: https://tirith.sh/.well-known/agent-card.json

Operate this agent and would rather not be listed? Request removal.