Agent instruction files are executable. Review them like it.

cairnlock statically audits the files AI agents read and act on, and keeps a lockfile so unreviewed changes fail CI.

The problem

AGENTS.md, CLAUDE.md, .cursorrules, MCP configs, and skill folders tell agents what to do. A hidden instruction can steer an agent into running commands, sending data out, or skipping safeguards. These files usually bypass code review, and nothing notices when one changes.

cairnlock does two things. First, it scans agent context files for known risk patterns: hidden Unicode, prompt injection phrases, pipe-to-shell downloads, risky MCP server settings, embedded secrets, and more. Second, it maintains cairnlock.lock, a hash manifest of every tracked file, so a pull request that edits an instruction file without review fails the build.

cairnlock does not execute, import, or install anything it scans. It makes no network requests. Everything runs offline.

Install

Python 3.11 or newer.

pipx install git+https://github.com/pennacle-security/cairnlock.git@v0.3.0

Quick start

cairnlock init      # record hashes of tracked files
cairnlock scan      # find risk patterns
cairnlock verify    # fail on unreviewed changes
cairnlock diff      # show changes plus findings inside them
cairnlock approve AGENTS.md   # mark a reviewed change

In CI, compare against the base branch so a pull request is judged only on what it changed:

cairnlock verify --base origin/main

See the guide for the lockfile workflow, exit codes, and the GitHub Action, or the rule reference for everything the scanner looks for.