Open-source tools for AI-agent security, observability, and code intelligence.
Local-first · useful in sixty seconds · designed for automation
Repositories · Ideas & feedback · Discussions
HookTripwire statically audits agent hooks, then HookGraph connects configuration to provable repository-local scripts and their findings—without executing a scanned command or uploading your configuration.
npx --yes github:mockingbird777/hooktripwire#v0.3.0 .claude .cursor .github/workflows --map-hooksOpen the interactive security lab → · Read the threat model · ☆ Star HookTripwire
| I need to… | Start with | Result |
|---|---|---|
| review AI-agent hooks before they run | HookTripwire | terminal, JSON, SARIF, or HTML security findings |
| inspect which failed retries have recovery evidence | SpanGarden | a high-confidence Recovery Ledger with timing and usage evidence |
| estimate the blast radius of an edited file | ArchLens | affected importers and bounded shortest-path witnesses |
| find events that tend to precede a failure | LogLoom | bounded precursor candidates with support, lift, and timing |
| catch API access being silently broadened | SpecSentinel | security alternatives and OAuth scope changes in every report |
| assemble complementary agent capabilities | Task2Tool | marginal lexical coverage and explicit uncovered task terms |
|
Trace reverse change impact from edited files to affected importers, with deterministic shortest witnesses, explicit safety limits, and unmatched-input disclosure.
|
Surface candidate failure precursors from already-redacted, same-service event sequences, ranked by support and lift and clearly labeled as association—not causality.
|
Catch breaking changes and declared access broadening: anonymous alternatives, removed OAuth/OpenID scopes, and newly added weaker security choices.
|
|
Compose complementary skills, prompts, MCP servers, and agents by marginal lexical coverage—then expose exactly which task terms remain uncovered.
|
HookGraph traces statically provable local references from agent hook configuration to scripts and findings, with bounded traversal and explicit unknown paths.
|
Recovery Ledger identifies only high-confidence serial retries that end in a non-error span, preserving auditable attempt IDs, timing, tokens, and local cost evidence.
|
- Local-first analysis. Analyzed code, logs, traces, and API contracts are not uploaded to a hosted backend.
- Fast time to value. Every project has a useful one-command path and realistic examples.
- Automation without lock-in. Stable JSON output, meaningful exit codes, and CI-ready workflows.
- Agentic systems with guardrails. Discover only what a task needs, inspect what automation may do, and explain what a run actually did.
- Trustworthy internals. Deterministic algorithms, documented trade-offs, tests, and no mystery cloud service.
# Map dependencies and cycles in the current repository
npx --yes github:mockingbird777/archlens#v0.3.0 . --impact src --output archlens-report.html
# Investigate a production log without uploading it
npx --yes github:mockingbird777/logloom#v0.3.0 analyze ./app.ndjson --precursors --html incident-report.html
# Protect an API contract in CI
npx --yes github:mockingbird777/specsentinel#v0.3.0 ./openapi.base.yaml ./openapi.next.yaml --format sarif
# Find the smallest useful set of agent capabilities for a task
npx --yes github:mockingbird777/task2tool#v0.3.0 compose "review and test a pull request" --root ./agents
# Audit AI-agent hooks before they execute
npx --yes github:mockingbird777/hooktripwire#v0.3.0 .claude .cursor .github/workflows --map-hooks
# Investigate an agent trace locally
npx --yes github:mockingbird777/spangarden#v0.2.0 ./trace.json --format html --output trace-report.htmlEach repository includes examples, architecture notes, a security policy, contribution guidance, and a public roadmap. If a tool saves you time, a star helps more developers discover it. Bug reports and focused pull requests are very welcome.
Local-first by design · Open source under the MIT License