What it defends
Talyx secures the artifact supply chain for AI coding agents — the MCP servers, skills, plugins, hooks and instruction files an agent loads from config before or during a session. The threat actor is a malicious or compromised artifact: a repo config that launches an attacker's package, a skill carrying hidden instructions, a tool description written to manipulate the model, a server impersonating a trusted one.
Detections
- Source-to-sink taint — a tree-sitter AST parse of JS/TS, Python and Ruby with a function-scoped, interprocedural taint pass: a read of an SSH key / cloud-credential file / browser store that reaches the network, traced across variable assignments, helper-function returns and parameters. Uncapped in the risk score.
- Malicious launch commands — structural capability extraction (the AST layer, with the regex rules as a parse-failure fallback) over JS/TS/Python/Ruby/Perl/shell, plus optional registry (npm/PyPI) resolution of the real package code.
- Prompt injection in skill markdown, instruction files and declared MCP tool descriptions — high-precision phrasing rules that require the verb's object to be the model's own instructions, role or safety.
- Hidden / invisible Unicode — zero-width characters, bidi overrides, and Unicode-tag ASCII smuggling.
- Encoded payloads — base64 / hex /
\xblobs decoded and re-scanned. - Data-exfiltration directives — one-sentence verb + secret + destination patterns.
- Tool shadowing & typosquatting — a server sharing a trusted name, or a near-miss of a well-known one, from a non-canonical source, scored across every discovered server at once.
- Poisoned tool descriptions — declared descriptions run through the same injection / Unicode / exfil detectors.
- Remote-code-execution hooks — a downloaded script piped straight into a shell.
- Plugin & extension ecosystems — the MCP servers, hooks and skills a Claude Code plugin, Gemini CLI extension or Antigravity plugin contributes, none of which appear in the agent's own config.
- Capability drift — a previously-approved artifact that has since gained a dangerous capability, forced back to review.
What it does not do (v1)
- Live traffic inspection (
talyx init --live, opt-in) covers the MCP handshake (initialize/tools/list/resources/list/prompts/list), a trust-on-first-use tool baseline that catches a mid-session rug-pull, the content oftools/call/resources/readresults (≤ 64 KiB), and a local guardrails file (custom block / redact / allow rules on any message). It is opt-in while it builds real-session mileage, and fails open to the launch-time protection — it never leaves you worse off than the gate alone. - No sandboxed detonation of untrusted code.
- No continuous filesystem watching or daemon.
- Detection is heuristic. High-signal findings drive automatic blocking; lower-signal ones surface as review prompts. It is a strong filter, not an oracle.
Data & privacy
No account, no daemon, no cloud backend, no telemetry, no analytics. The
only outbound calls are: optional npm/PyPI registry lookups when you pass
--fetch-registry, and a license check against Lemon Squeezy on
activation and roughly monthly thereafter. Talyx never transmits your
config contents, findings, file paths, or code anywhere.
Auditability
The scanner core is source-available. Every detection rule — every regex, every score contribution, every threshold — is in the repository and covered by tests, many proven against live adversarial fixtures (real SSH-exfiltration payloads genuinely blocked, benign hooks genuinely running). Heuristic detectors are tuned against a real benign corpus to keep false blocks near zero. Read the code.
Security disclosure
Found a bypass or a false block that matters? Email security@gettalyx.dev. We respond within 72 hours and credit reporters who want it.