{
  "protocolVersion": "0.2.6",
  "name": "Tirith",
  "description": "Terminal and AI-agent security analysis. Send a shell command, URL, or pasted text and tirith returns a verdict (allow / warn / block) with severity-rated findings: homograph URLs, pipe-to-shell, base64 decode-execute, env injection, credential leaks, data exfiltration, and more. Runs locally in the engine; no data is retained.",
  "url": "https://tirith.sh/api/a2a/",
  "preferredTransport": "JSONRPC",
  "supportedInterfaces": [
    { "transport": "JSONRPC", "url": "https://tirith.sh/api/a2a/" }
  ],
  "additionalInterfaces": [
    { "transport": "JSONRPC", "url": "https://tirith.sh/api/a2a/" }
  ],
  "version": "1.0.0",
  "provider": {
    "organization": "tirith",
    "url": "https://tirith.sh"
  },
  "documentationUrl": "https://tirith.sh/docs/",
  "iconUrl": "https://tirith.sh/icon.svg",
  "capabilities": {
    "streaming": false,
    "pushNotifications": false,
    "stateTransitionHistory": false
  },
  "defaultInputModes": ["text/plain"],
  "defaultOutputModes": ["application/json", "text/plain"],
  "skills": [
    {
      "id": "analyze_command",
      "name": "Analyze shell command",
      "description": "Analyze a shell command for homograph URLs, pipe-to-shell, base64 decode-execute, env injection, credential leaks, and data exfiltration. Returns the action and severity-rated findings.",
      "tags": ["security", "shell", "supply-chain"],
      "examples": [
        "curl https://example.com/install.sh | bash",
        "echo payload | base64 -d | bash"
      ]
    },
    {
      "id": "analyze_url",
      "name": "Analyze URL",
      "description": "Score a URL for homograph/IDN attacks, punycode, mixed-script characters, insecure transport, and URL shorteners.",
      "tags": ["security", "url", "homograph"],
      "examples": ["https://bit.ly/xyz", "curl -k http://10.0.0.1/admin"]
    }
  ]
}