cairnlock 
     ██████  █████  ██ ██████  ██   ██
    ██▄▄▄▄  ██   ██ ██ ██  ██  ███  ██
    ██▀▀▀▀  ███████ ██ ██████  ████ ██
    ██▄▄▄▄  ██   ██ ██ ██  ██  ██ ████
     ▀▀▀▀▀  ██   ██ ██ ██  ██  ██   ██
      ██      █████  ██████  ██   ██
      ██      ██   ██ ██▄▄▄▄  ██  ██
      ██      ██   ██ ██▀▀▀▀  █████
      ██      ██   ██ ██▄▄▄▄  ██  ██
      ███████  █████   ▀▀▀▀▀  ██   ██

Agent instruction files are executable. Review them like it.

cairnlock statically audits the files AI agents read and act on, and keeps a lockfile so unreviewed changes fail CI.

pipx install cairnlock Read the guide Star the repo

The problem

AGENTS.md, CLAUDE.md, .cursorrules, MCP configs, and skill folders tell agents what to do. A hidden instruction can steer an agent into running commands, sending data out, or skipping safeguards. These files usually bypass code review, and nothing notices when one changes.

cairnlock does two things. First, it scans agent context files for known risk patterns: hidden Unicode, prompt injection phrases, pipe-to-shell downloads, risky MCP server settings, embedded secrets, and more — nineteen rules across two profiles. Second, it maintains cairnlock.lock, a hash manifest of every tracked file, so a pull request that edits an instruction file without review fails the build. Base verification also catches the pull request that edits the file and rehashes the lockfile in the same commit.

cairnlock does not execute, import, or install anything it scans. It makes no network requests. Everything runs offline.

Install

Python 3.11 or newer.

pipx install cairnlock

Or run it without installing:

uvx cairnlock scan

Quick start

cairnlock init      # record hashes of tracked files
cairnlock scan      # find risk patterns
cairnlock verify    # fail on unreviewed changes
cairnlock diff      # changes, with findings inside them
cairnlock approve AGENTS.md   # mark a reviewed change

In CI, compare against the base branch so a pull request is judged only on what it changed:

cairnlock verify --base origin/main

See the guide for the lockfile workflow, exit codes, and the GitHub Action, the rule reference for everything the scanner looks for, and the FAQ for the questions that come up on day three of using any security tool.