Tirith
Germany
What it is
Tirith is a free, open-source Linux command-line tool that evaluates infrastructure documents against declarative JSON policies. It reports passed and failed rules together with the affected resource and value. Its pipeline gate checks Terraform plan output and can return a nonzero exit code when a policy violation appears, before infrastructure changes are applied. Documented inputs include Terraform plans and state, Kubernetes manifests, Infracost breakdowns, and other JSON documents. Policies can use providers and evaluators such as ContainedIn, Equals, and RegexMatch, while the provider architecture can be extended for additional formats. In local mode, evaluation runs on the user’s runner, and the project says policies and documents are not sent elsewhere. Optional organization mode checks plans against StackGuardian organization policies and uploads a masked document for evaluation. Tirith can run through GitHub Actions, GitLab or other container-based CI jobs, Bitbucket Pipelines, other CI systems, and the local CLI. OpenTofu plans work like Terraform plans for the documented gate. A beta terminal interface offers result exploration, policy building, and examples.
For and against
For
- Free Apache-2.0 open-source CLI
- Supports Terraform, Kubernetes, Infracost, and JSON
- Nonzero exit code can block policy violations
- Local mode keeps evaluation on the runner
- GitHub Actions and multiple CI options
Against
- No GitLab-native action equivalent
- Optional organization mode uploads masked documents
- Terminal interface is beta
The verdict
Tirith provides policy evaluation and pipeline gating for several infrastructure document types. Its local mode, extensible providers, and CI options make it suitable for teams that want declarative JSON guardrails.
Who it suits
Tirith suits DevSecOps engineers, infrastructure architects, cloud administrators, and others enforcing infrastructure guardrails. It is useful for teams placing policy checks in CI pipelines.
Plans and prices
Tirith (Apache-2.0)
Open-source CLI; no account required; optional StackGuardian organization mode
Read 7 Oct 2026 · github.com
On the record
- CI integrations
- The README documents a GitHub Actions integration and direct CLI use in GitLab or other container-based CI jobs.github.com · read 7 Oct 2026
- Intended users
- The project names DevSecOps engineers, infrastructure architects, cloud administrators, and others who manage or enforce infrastructure guardrails.github.com · read 7 Oct 2026
- Interactive interface
- The optional beta terminal interface provides an Explorer for results, a Builder for policies, and a Playground for examples; it can also be served in a browser.github.com · read 7 Oct 2026
- Maker and founding
- StackGuardian says it was founded in 2022.stackguardian.io · read 7 Oct 2026
- Notable limitation
- The maker says there is no GitLab-native action equivalent, so GitLab users invoke the CLI directly.github.com · read 7 Oct 2026
- OpenTofu
- The maker's site says OpenTofu plans work identically to Terraform plans for the documented gate.stackguardian.github.io · read 7 Oct 2026
- Organization mode
- The optional platform check evaluates plans against policies enforced by a StackGuardian organization and uploads a masked document to StackGuardian for evaluation.github.com · read 7 Oct 2026
- Other CI platforms
- The maker's site lists GitHub Actions, GitLab CI, Bitbucket Pipelines, any CI, and local CLI as ways to run Tirith.stackguardian.github.io · read 7 Oct 2026
- Pipeline gate
- It checks Terraform plan output and can return a nonzero exit code for a policy violation before infrastructure changes are applied.github.com · read 7 Oct 2026
- Policy features
- Policies can use providers and evaluators such as ContainedIn, Equals, and RegexMatch, and the provider architecture can be extended for other input formats.github.com · read 7 Oct 2026
- Policy maintenance
- The CLI includes lint and format commands, and both are published as pre-commit hooks.github.com · read 7 Oct 2026
- Purpose
- Tirith evaluates infrastructure documents against declarative JSON policies and reports which rules passed or failed, including the affected resource and value.github.com · read 7 Oct 2026
- Sensitive values
- In local mode, evaluation runs on the user's runner and the project says that policies and documents are not sent anywhere.github.com · read 7 Oct 2026
- Supported inputs
- The project documents support for Terraform plans and state, Kubernetes manifests, Infracost breakdowns, and other JSON documents.github.com · read 7 Oct 2026
