Skip to content
SPECIFICTION
Get listed

Tirith

github.com

Free plan Linux
Visit github.com
Spec score 7.1 #19 of 25 in Infrastructure Policy as Code Tools

What it is

Tirith is a free, open-source Linux command-line tool that evaluates infrastructure documents against declarative JSON policies. It reports passed and failed rules together with the affected resource and value. Its pipeline gate checks Terraform plan output and can return a nonzero exit code when a policy violation appears, before infrastructure changes are applied. Documented inputs include Terraform plans and state, Kubernetes manifests, Infracost breakdowns, and other JSON documents. Policies can use providers and evaluators such as ContainedIn, Equals, and RegexMatch, while the provider architecture can be extended for other formats. Local evaluation runs on the user’s runner, and the project says policies and documents are not sent elsewhere. Optional organization mode checks plans against StackGuardian policies and uploads a masked document. Tirith documents GitHub Actions, GitLab CLI use, Bitbucket Pipelines, other CI, and local execution. OpenTofu plans work like Terraform plans for the documented gate.

Spec sheet

Purpose
Tirith evaluates infrastructure documents against declarative JSON policies and reports which rules passed or failed, including the affected resource and value.Read 7 Oct 2026 · github.com
Intended users
The project names DevSecOps engineers, infrastructure architects, cloud administrators, and others who manage or enforce infrastructure guardrails.Read 7 Oct 2026 · github.com
Headquarters
GermanyRead 28 Sep 2026 · github.com
CI integrations
The README documents a GitHub Actions integration and direct CLI use in GitLab or other container-based CI jobs.Read 7 Oct 2026 · github.com
Interactive interface
The optional beta terminal interface provides an Explorer for results, a Builder for policies, and a Playground for examples; it can also be served in a browser.Read 7 Oct 2026 · github.com
Maker and founding
StackGuardian says it was founded in 2022.Read 7 Oct 2026 · stackguardian.io
Notable limitation
The maker says there is no GitLab-native action equivalent, so GitLab users invoke the CLI directly.Read 7 Oct 2026 · github.com
OpenTofu
The maker's site says OpenTofu plans work identically to Terraform plans for the documented gate.Read 7 Oct 2026 · stackguardian.github.io
Organization mode
The optional platform check evaluates plans against policies enforced by a StackGuardian organization and uploads a masked document to StackGuardian for evaluation.Read 7 Oct 2026 · github.com
Other CI platforms
The maker's site lists GitHub Actions, GitLab CI, Bitbucket Pipelines, any CI, and local CLI as ways to run Tirith.Read 7 Oct 2026 · stackguardian.github.io
Pipeline gate
It checks Terraform plan output and can return a nonzero exit code for a policy violation before infrastructure changes are applied.Read 7 Oct 2026 · github.com
Policy features
Policies can use providers and evaluators such as ContainedIn, Equals, and RegexMatch, and the provider architecture can be extended for other input formats.Read 7 Oct 2026 · github.com
Policy maintenance
The CLI includes lint and format commands, and both are published as pre-commit hooks.Read 7 Oct 2026 · github.com
Sensitive values
In local mode, evaluation runs on the user's runner and the project says that policies and documents are not sent anywhere.Read 7 Oct 2026 · github.com
Supported inputs
The project documents support for Terraform plans and state, Kubernetes manifests, Infracost breakdowns, and other JSON documents.Read 7 Oct 2026 · github.com

Plans and prices

Tirith (Apache-2.0) Free Open-source CLI; no account required; optional StackGuardian organization mode Read 7 Oct 2026 · github.com

Every Tirith plan and price →

Strong points and limits

Strong points

  • Free open-source CLI
  • Nonzero exit codes can gate pipelines
  • Supports Terraform, Kubernetes, Infracost, and JSON
  • Local mode keeps documents on the runner
  • Policy lint and format commands

Limits

  • No GitLab-native action equivalent
  • Organization mode uploads a masked document
  • Interactive terminal interface is beta
  • Linux platform only

Who it suits

Tirith suits DevSecOps engineers, infrastructure architects, cloud administrators, and others enforcing infrastructure guardrails. It fits teams that want policy checks in CI or on a local runner.

Verdict

Tirith provides policy-based checks for infrastructure documents with CI and local workflows. Its GitLab integration requires direct CLI invocation, and organization mode has different data handling from local evaluation.

Where Specifiction places it

Alternatives to TirithAll alternatives →