Lodeline is an open-source (Apache-2.0) config scanner for AI coding agents. It reads the config files that decide what Claude Code, Codex, Cursor, Gemini CLI and other agents may do: sandbox, permissions, hooks, MCP servers and instruction files. It scores the risk and suggests how to reduce it. It runs locally and blocks nothing by default.
curl --proto '=https' --tlsv1.2 -fsSL https://raw.githubusercontent.com/Ju571nK/lodeline/main/install.sh | sh
Read install.sh first. It checks each download against the release's SHA256SUMS. Prefer a package? .deb, .rpm and Windows .zip are on GitHub Releases.
v0.12.0Sigil is now Lodeline: new names for every binary and packageLodeline only reads. One lodeline scan gives you a score per agent and a one-line hint for each kind of finding. Leave the daemon on and it re-scores whenever a config file changes. Blocking and the fleet are optional extras you add on purpose.
Swipe sideways to see the whole diagram.
A command only runs because some config allowed it. Lodeline scores that config across every AI coding agent you use, and it is the same config an attacker looks for. The names below are the finding kinds you will see in lodeline scan.
Read the deep-dive: why the config file is the real attack surface →Whether the agent runs inside a sandbox, or has it switched off and reaches your whole host.
Wildcard allow rules, empty deny lists, and modes that run tool calls without asking, such as Claude Code defaultMode auto or bypassPermissions, or Codex approval_policy = "never". Scheduled tasks that run Claude Code unattended count too.
Hooks with wildcard matchers or destructive commands, wherever they are declared: settings.json, skill and subagent frontmatter, and Codex config.toml and hooks.json at user, repo and system level. A bash <script> hook gets its script read as well.
Servers that launch a local command, launch through a shell or a temp path, point at a remote URL, or start on their own when you open a project folder.
Tool descriptions the model reads and you never see. Lodeline flags instructions aimed at the agent, hidden Unicode, and two servers offering the same tool name. With the daemon on, it keeps a baseline and reports when a tool's metadata changes. Today this reads the Codex tool cache.
Prompt-injection lines planted in CLAUDE.md, AGENTS.md, .cursorrules or .cursor/rules: fetch-and-run, destructive commands, obfuscation, override markers.
Run it whenever, or leave the daemon on. It re-scores the moment a config changes, and when a dangerous toggle flips from off to on (auto-approve, sandbox off, a broad allow, project MCP autorun) it records a one-time drift event.
Every filled cell maps to a check in the Lodeline source at v0.12.0. An empty cell means Lodeline does not read that config for that agent yet.
Swipe sideways to see the whole diagram.
Lodeline doesn't sit in your way or intercept your commands. It reads posture and gives you a score per agent and a one-line hint for each kind of finding. It never edits your config, and lodeline scan always exits 0. Your agent keeps working.
lodeline-hook registers as a PreToolUse hook for Claude Code, Codex or Cursor. It denies nothing until you turn on --enforce and write your own deny rules; Lodeline ships none. It matches Bash deny rules against the command the shell would actually run, so a rule written as rm -rf / also catches respellings like r''m -rf /, rm${IFS}-rf${IFS}/ or sudo sh -c 'rm -rf /', the class Adversa AI published as GuardFall. When it can't know the command without running it, such as $(…), eval or a pipe into a shell, it reports a bash_indirection shape you can deny on. Enforcement runs on macOS and Linux.
How deny rules are matched →lodeline-mcp registers as an MCP server named lodeline-check. With the Lodeline daemon running, your agent can call it to read this machine's score and explain it in plain words. It is read-only and has no write path.
If you've got Claude Code and Codex running unattended across several boxes, each one has its own posture, and you can't watch them all by hand. The same scan rolls up across machines, so one view shows which host is riskiest and why.
Each host talks to your lodeline-server over mTLS with its own client certificate, which the server can issue at enrollment from a single-use token. Hosts with no internet access can pull release packages and checksums from the server instead of GitHub.
Latest: v0.12.0, released 2026-10-31. Sigil is now Lodeline: every binary, package, path and environment variable takes the new name, and the old command is gone. Migrating from Sigil lists what to change on an existing install. Earlier releases shipped as sigil and keep that name below. v0.11.0 (2026-10-30) reads hook scripts started through env or interpreter options and skips Codex hooks that Codex will not run. v0.10.0 (2026-10-28) scored hooks in Claude Code skills and subagents and Codex hooks.json, and let the sigil, sigil-sender and sigil-server .deb packages share one host.
All release notes on GitHub →Swipe sideways to see the whole diagram.
No. lodeline scan, the daemon, lodeline-hook and lodeline-mcp in its default local mode read files on your machine and contact no server. There is no account and no telemetry. Data leaves a host only if you install the fleet profile and point lodeline-sender at a lodeline-server you run yourself.
Not by default. Lodeline reads config and reports a score, findings and hints. It never edits your files. Blocking exists only as the opt-in --enforce mode of lodeline-hook, with deny rules you write.
It scores Claude Code, Codex, Cursor, Gemini CLI, Antigravity, Continue.dev and Claude Desktop. It runs on macOS, Linux and Windows. On Windows the scanner works, while lodeline-hook enforcement and the local lodeline-mcp mode are macOS and Linux only for now.
A sandbox limits what a process can touch while it runs. EDR records what ran. Lodeline looks one step earlier, at the config that grants the permission: whether the sandbox is on at all, what is auto-approved, which hooks and MCP servers start. It works next to both rather than replacing either.
Yes. Everything on this page is open source under Apache-2.0 and free to use, with no account to create.
Free, open source, and it sends nothing off your machine.