Tripwire

Why it's ranked here

The case for it is the fail-closed design, written down as a formal decision and enforced in the database rollup: an item where no checker completed shows grey, not green. It is MIT licensed and declares a 95 percent test coverage floor on its Python scan code. The case against is maturity. The project calls itself early-adopter software, its own status page marks several checkers as implemented but not verified on a live run, and a real scan needs Supabase and Modal accounts plus separate keys for each commercial checker. Worth a look for teams vetting agent add-ons, not yet a drop-in tool.

What's good

Skips are labeled precisely. A missing credential, a broken checker and an unsupported language each get their own state, so a quiet result cannot pass as a safe one. Rust projects get a dedicated audit against the RustSec advisory database because Snyk does not cover them, and that gap is stated rather than hidden. Quoted findings count as verified only when the quoted text actually exists at the reported line. A CI check keeps the late checkers inside the five minute container limit. A mock mode and a hosted demo show the interface with no accounts at all.

Tradeoffs

Setup is heavy. A live scan needs a Supabase project and a Modal account, and full coverage adds Snyk, Tessl and Cisco keys, with Ossprey access still described by the project as not provisioned. Checkers run one after another under a 300 second container cap, so a slow early checker can starve later ones. The browser interface still lives under a prototypes folder. The database grants anonymous read on every results table, which suits a demo but means findings are readable by anyone holding the public key. The optional AI triage step sends findings to Superlinked and Alibaba Cloud.

How to use it well

Best fit is a platform or security engineer who wants one view of what several commercial checkers say about the agent skills and MCP servers a team relies on, and who is willing to wire up accounts. Start with mock mode and a dry discovery run, then go live with only the database and container accounts before adding paid checkers. Treat grey and skipped states as work to do, not as passes. It does not replace the underlying checkers, and the install-blocking guard hook is explicitly outside the current release scope.

Observed

License

MIT

Languages

Python (requires 3.12+) scan sandbox; Node.js CLI (engines node >=18)

Interface

CLI binary named tripwire with scan, setup and route commands

Packaging

Python wheel built with hatchling containing the sandbox and guard packages; no required runtime dependencies

Required services for live scans

Supabase (Postgres) and Modal; Snyk, Tessl, Cisco and Ossprey keys optional per checker

Failure policy

Missing keys report skipped_missing_credential; crashes, timeouts and malformed output report unreachable, never a clean result

Test coverage gate

Coverage fail_under set to 95 for the sandbox package

Database access

Row level security enabled with anonymous SELECT on results tables; writes require the service role

Scan time budget

Sequential checkers with a 240s per-call cap inside a 300s container kill

Security policy

Private disclosure requested; deliberately vulnerable demo fixtures are documented as test data