From 0d19b9eefbf03b8c33dc3069478651764986380f Mon Sep 17 00:00:00 2001
From: sheeki003 <36009418+sheeki03@users.noreply.github.com>
Date: Mon, 23 Mar 2026 21:58:48 +0530
Subject: [PATCH] docs: add tirith security scanning section to README

---
 README.md | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/README.md b/README.md
index e25366ef8..0bf4e898b 100644
--- a/README.md
+++ b/README.md
@@ -452,6 +452,24 @@ PicoClaw can search the web to provide up-to-date information. Configure in `too
 | [SearXNG](https://github.com/searxng/searxng) | Not needed | Self-hosted | Free metasearch engine |
 | [GLM Search](https://open.bigmodel.cn/) | Required | Varies | Zhipu web search |
 
+### 🛡️ Tirith Security Scanning
+
+Shell commands are pre-screened by [Tirith](https://github.com/sheeki03/tirith) before execution. Tirith detects homograph/punycode URLs, pipe-to-shell patterns, terminal injection, typosquatted packages, and insecure transport. Auto-installed on first use with SHA-256 checksum verification. Also integrated in [Hermes Agent](https://github.com/NousResearch/hermes-agent/pull/1256).
+
+Configure via `config.json`:
+```json
+{
+  "tools": {
+    "exec": {
+      "tirith_enabled": true,
+      "tirith_bin": "tirith",
+      "tirith_timeout": 5,
+      "tirith_fail_open": true
+    }
+  }
+}
+```
+
 ### ⚙️ Other Tools
 
 PicoClaw includes built-in tools for file operations, code execution, scheduling, and more. See [Tools Configuration](docs/tools_configuration.md) for details.