Trustline

Trustline

**Trusted baseline + auto-rollback for AI agent configuration files.**

AI coding agents (Claude Code, Cursor, Codex, ...) load rules from files such as `.claude/`, `AGENTS.md`, `.cursorrules` and `.mcp.json`. Those files are now a supply-chain attack surface: cloning a repository or installing a third-party MCP can silently inject instructions that tell your agent to exfiltrate secrets, tamper with your shell, or hide its own actions.

Existing scanners (medusa, Snyk agent-scan, Cisco mcp-scanner, ...) **detect** such tampering. Trustline is the missing **recovery layer**: it keeps a trusted baseline of your agent configuration files and can roll them back — and, through Claude Code hooks, block suspicious loads *before* they reach the model.

What it does

• trustline init — establish a trusted baseline (SHA-256 snapshot) of managed agent files.
• trustline status — diff the working tree against the baseline (added / modified / deleted).
• trustline scan — static heuristic scan for prompt-injection / exfiltration / privilege-tampering signals (15 rules in v0.1).
• trustline rollback [files...] — restore files to the baseline (git HEAD first, then local snapshots; soft rollback keeps .bak).
• trustline export-sarif — emit scan findings as SARIF for CI / DefectDojo.
• trustline hook install — wire Claude Code hooks (SessionStart / file-load / PreToolUse) to verify before the agent trusts a rules file.

Install

pip install trustline        # or: uv tool install trustline

Quick start

cd ~/some-repo-you-cloned
trustline init                 # review listed files, press enter -> baseline saved
trustline status               # nothing changed yet
trustline scan --sarif         # heuristic scan of managed files
# ... after a suspicious change ...
trustline status               # shows: MODIFIED .claude/settings.json
trustline scan .claude/settings.json
trustline rollback .claude/settings.json   # back to trusted s