Open-source tools for AI-agent security, observability, and code intelligence.
Local-first · useful in sixty seconds · designed for automation
Repositories · Ideas & feedback · Discussions
HookTripwire statically audits agent hooks, workflow files, permissions, and shell-backed automation without executing a scanned command or uploading your configuration.
npx --yes github:mockingbird777/hooktripwire .claude .cursor .github/workflowsOpen the interactive security lab → · Read the threat model · ☆ Star HookTripwire
| I need to… | Start with | Result |
|---|---|---|
| review AI-agent hooks before they run | HookTripwire | terminal, JSON, SARIF, or HTML security findings |
| explain a slow or looping agent run | SpanGarden | critical paths, retries, errors, tokens, and cost |
| understand an unfamiliar codebase | ArchLens | interactive dependencies, cycles, and hotspots |
| investigate noisy production logs locally | LogLoom | redacted patterns, anomalies, and a shareable report |
| stop breaking OpenAPI changes in CI | SpecSentinel | human, Markdown, JSON, HTML, or SARIF contract diff |
| find the right capability for an agent task | Task2Tool | a ranked, explainable shortlist of skills and tools |
|
Turn a repository into an interactive dependency map. Find cycles, architectural hotspots, and high-coupling files without sending source code anywhere.
|
Weave noisy logs into a private, shareable investigation report with automatic parsing, redaction, pattern clustering, latency percentiles, and anomaly signals.
|
Catch breaking and security-relevant OpenAPI changes before they reach production. Human, Markdown, JSON, and SARIF output make it equally useful locally and in CI.
|
|
Turn a natural-language task into a ranked shortlist of local skills, prompts, MCP servers, agents, and portable catalogs—without bloating the context window.
|
Audit coding-agent hooks and automation before execution. Catch dangerous commands, broad permissions, secret exfiltration, and mutable dependencies offline.
|
Grow raw AI-agent traces into critical paths, retry and loop signals, latency, tool/model usage, token totals, and opt-in local cost estimates.
|
- Local-first privacy. Your code, logs, and API contracts stay on your machine.
- Fast time to value. Every project has a useful one-command path and realistic examples.
- Automation without lock-in. Stable JSON output, meaningful exit codes, and CI-ready workflows.
- Agentic systems with guardrails. Discover only what a task needs, inspect what automation may do, and explain what a run actually did.
- Trustworthy internals. Deterministic algorithms, documented trade-offs, tests, and no mystery cloud service.
# Map dependencies and cycles in the current repository
npx --yes github:mockingbird777/archlens . --output archlens-report.html
# Investigate a production log without uploading it
npx --yes github:mockingbird777/logloom analyze ./app.ndjson --html incident-report.html
# Protect an API contract in CI
npx --yes github:mockingbird777/specsentinel ./openapi.base.yaml ./openapi.next.yaml --format sarif
# Find the smallest useful set of agent capabilities for a task
npx --yes github:mockingbird777/task2tool find "review a pull request" --root ./agents
# Audit AI-agent hooks before they execute
npx --yes github:mockingbird777/hooktripwire .claude .cursor .github/workflows
# Investigate an agent trace locally
npx --yes github:mockingbird777/spangarden ./trace.json --format html --output trace-report.htmlEach repository includes examples, architecture notes, a security policy, contribution guidance, and a public roadmap. If a tool saves you time, a star helps more developers discover it. Bug reports and focused pull requests are very welcome.
Local-first by design · Open source under the MIT License