tyga-cli

Safety firewall CLI wrapper. Prefix any command with tyga to run it through Gate 1 safety checks.

Install

curl -fsSL https://a2ainfrastructure.com/install.sh | bash
# or manually:
cp tyga /usr/local/bin/tyga && chmod +x /usr/local/bin/tyga

Usage

tyga echo hello          # allowed — runs normally
tyga rm -rf /            # BLOCKED by Safety firewall
tyga python script.py    # allowed — runs normally
tyga cat /etc/shadow     # BLOCKED by Safety firewall

Pipeline mode

Set these env vars to route through a2ainfrastructure.com (adds Gate 2 LLM judge + sandbox):

export TYGA_API_URL=https://a2ainfrastructure.com
export TYGA_API_KEY=a2a_your_key_here
export TYGA_PIPELINE=your_pipeline_id
tyga python untrusted_script.py  # executes in sandbox

How it works

1. Gate 1 (local): Regex denylist checks the command against 17 patterns covering filesystem destruction, reverse shells, credential access, privilege escalation, and code injection
2. Gate 2 (optional, pipeline mode): Submits to a2ainfrastructure.com where a stateless LLM judge evaluates the command with zero conversation context
3. Execution: If both gates pass, the command executes (locally or in sandbox)