Trooth CLI
Check it in the plan, not the audit.
Check a Terraform plan against SOC 2, ISO 27001, GDPR, HIPAA, NIST AI RMF and the EU AI Act, straight from your terminal or CI. Advisory and report-only. Trooth never applies changes.
# Install once, or skip it and use npx.
npm install -g trooth
# Turn a plan into JSON, then scan it.
terraform show -json plan.tfplan > plan.json
trooth scan plan.json
soc2 3 findings advisory
iso27001 1 finding advisory
exit 0 report-only nothing applied
- Input
- Terraform plan, JSON
- Changes
- None
- Default
- Advisory, exit 0
What it does
It cannot change anything
There is no apply path in the binary. The scan posts your declared plan to Pre-Flight and prints what it found. Advisory by default, exit code 0 even with findings.
It reads the plan, not your cloud
Input is a Terraform plan in JSON. Trooth does not need credentials to your account to tell you what the plan would do to your posture.
It belongs in the pull request
Pass --strict and the command exits non-zero on a finding, so a posture regression fails the build that caused it instead of surfacing in an audit.
Usage
Three ways to run it.
Same binary in each. Zero dependencies, Node 18 or newer.
# No install. Runs the published binary straight from the registry.
terraform show -json plan.tfplan > plan.json
npx trooth scan plan.jsonFlags
- --strict
- Exit non-zero when findings exist. Default is exit 0, so the scan is advisory until you ask for it not to be.
- --json
- Print the raw Pre-Flight response instead of the summary.
- TROOTH_API
- Point the binary at a different base URL. Defaults to api.trooth.co. Neither scan nor check sends a credential, so there is no key to set for either.
Check any company
Read the network, not just the plan.
The same binary reads the public Trooth Network. Ask for any company by domain and it prints their witnessed standing, by discipline, with the badge and scan IDs you can verify. No key, no account, and three distinct answers rather than two.
What it can answer
- Listed · exit 0
- The network holds a witnessed record for this company, and it is printed with the scan ids behind it.
- Not listed · exit 0
- The network was read and holds no record for this company. That is an answer, not a failure, and it is not a statement that the company is untrustworthy.
- Could not read · exit 75
- Trooth did not answer. Nothing is known about this company right now, and the CLI says so instead of printing “not listed”. A pipeline that treats this as an absent record would fail a build because of a Trooth outage, so it exits distinctly and prints nothing about the company at all.
# No install, no key. Read a company by domain.
npx trooth check trooth.co
Trooth, LLC trooth.co Listed
witnessed: legal security ai business ip
live probes + attestations, each with a scan id
read-only not a certification
# A network that did not answer is not an empty record.
npx trooth check example.com
could not read the network - nothing is known right now
exit 75
CLI · GitHub Action · Webhooks
Wire it into the pipeline you already have.
The CLI, the GitHub Action and the webhooks all read the same witnessed record the dashboard does. Every claim carries a receipt.