What is agent-zero-trust?

This tool scans a code repository before an AI coding agent like Claude Code, Cursor, Codex, or Gemini is allowed to work inside it, looking for hidden instructions that could manipulate the agent. The idea is that a repository is not just code anymore. For an AI agent that reads and follows files, a README, a hidden HTML comment, a configuration file, or a startup script can act as an instruction, sometimes ones the human never sees rendered on screen but that the agent still reads as plain text. The scanner is deterministic and works entirely offline using only Python's standard library, and it never calls another AI model itself, since a checker that asks a model whether content is safe could itself be tricked by that same content. When it finds a problem, it reports findings ranked from high to medium severity, showing exactly which file and line triggered it and why, such as an instruction hidden in an HTML comment telling the agent to hide its activity, or a command that downloads and runs code from the internet in one step. It exits with a nonzero status code when serious findings are present, which makes it easy to plug into automated checks. It looks at a wide range of files that can influence an agent, including agent instruction files, Claude Code hooks, MCP server configs, git hooks, package lifecycle scripts, and CI workflow files. It checks for instruction overrides, hidden imperatives, commands that pipe downloaded content straight into a shell, credential and token patterns, and other automation traps. It can also run as a GitHub Action that fails a pull request check when these patterns show up, and it offers an optional gate mode that blocks an agent's file-editing tools in a workspace until a scan has passed. The tool is upfront that a clean scan only means no known attack pattern was found, not that a repository is fully safe, and it publishes its own known false negatives publicly so its limits stay visible. This is aimed at developers and teams who use AI coding agents and want an automated first check before letting an agent operate in an unfamiliar or newly cloned repository. It installs via pip or pipx and is written in Python.