eyebrow
A single static binary that discovers every skill, MCP server, plugin, hook and rule installed across a machine's AI coding tools, hashes them into a lockfile, statically scans them, and detects post-audit modification before it can cause harm.
eyebrow gives a developer a committable lockfile recording exactly what is installed across their AI coding tools and what each item does, and reports the moment any of it changes, since skills, MCP servers and hooks run with the user's own privileges and can change after they were audited.
The read-only scan-and-verify component and a runtime MCP firewall, a wrap command with sandboxing and an egress proxy, are implemented; a local embedded dashboard with usage telemetry, fleet blast-radius, policy conformance and an opt-in reputation signal is planned, alongside a separately designed hosted team API. CI gating is supported through stable exit codes for clean, drift-over-threshold, usage-error and internal-error outcomes.
Release binaries are unsigned by choice and instead ship checksums and build-provenance attestation for verification; it also installs via Homebrew, a shell installer, or building from source with Go 1.25 or newer.