Tirith

What Tirith is

Tirith is a free, open-source command-line tool for evaluating infrastructure documents against JSON policies. It reports which rules pass or fail and identifies the affected resource and value. Its pipeline gate checks Terraform plan output and can return a nonzero exit code for a policy violation before infrastructure changes are applied. Documented inputs include Terraform plans and state, Kubernetes manifests, Infracost breakdowns, CloudFormation, and other JSON documents. Policies can use evaluators such as ContainedIn, Equals, and RegexMatch, and the provider architecture can be extended for other input formats. In local mode, evaluation runs on the user's runner; the project says policies and documents are not sent elsewhere. Optional organization mode checks plans against StackGuardian policies and uploads a masked document for evaluation. Tirith can run in GitHub Actions and other container-based CI jobs, with direct CLI use for GitLab. OpenTofu plans work like Terraform plans for the documented gate. An optional beta terminal interface provides results exploration, policy building, and examples, and can also be served in a browser.