Tripwire scans agentic artifacts before Claude Code trusts them — and blocks the ones that shouldn't be running in your terminal.
Skills, MCP servers, and packages are the new install surface for coding agents — and 2026 is the year attackers noticed.
Documented 2026 incidents follow the same three beats — a helpful-looking install, a trusted execution context, and a quiet exfiltration.
A skill, MCP server, or package is added the same way a trusted one would be. Marketplaces prioritize openness over vetting — there's no gate at the door.
Once loaded, its content sits in the same context the agent reasons over. A dependency helper can quietly redirect installs; a config file can inject commands before any trust dialog appears.
API keys, SSH keys, and environment variables are exfiltrated through normal-looking output — "installing dependency," "running scan" — while the malicious path persists for every future call.
Tripwire sits between Claude Code's hook system and every skill, tool, or MCP call — dispatching to a scanner and relaying a verdict before execution proceeds.
Scanned within the validity window, no findings. Runs — soft-report only.
Findings below the block threshold. Logged and surfaced, execution allowed.
At or above threshold. Execution is refused — always with an explicit block reason.
Never scanned, or scan older than the validity window — blocked when enforcement is on.
Built at Frontline Hackathon London 2026: the integration layer that connects Claude Code's hook system to Tripwire's existing scan engine — enforcing from the moment of install.
Resolves one or more names, reports fresh / stale / unscanned / scanning / not-found status — human table and JSON.
Submits artifacts for scanning via Tripwire's existing API. --force resubmits over a valid result.
Turns on enforcement across skills, tools, and MCP uniformly via the config flag.
Full bypass at the enforcement layer. Manual verify/scan keep working regardless.
Runs the same status logic against Tripwire's own five skills — the guard, guarding itself.
The integration layer is live. What extends next is Tripwire's own dispatch capability — pluggable scanners behind the same RAG verdict contract.
Handler scripts, PreToolUse wiring, config bootstrap, the five /tw-* skills, demo artifacts, regression pass.
Dependency-focused scanner added as a pluggable dispatch target.
Access provisioning, then wiring as a second pluggable scanner.
Runtime visibility into what's actually being invoked, not just what's installed.
End-to-end verification across the whole pipeline — including running /tw-self-check as a live gate.
The integration layer's own frontend and backend, rebuilt on what Phases 1–5 proved out.