Tirith review

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Tirith is an open-source policy framework and CLI from StackGuardian for evaluating infrastructure and workflow configurations against declarative JSON policies. It is designed for DevSecOps engineers, infrastructure architects, cloud administrators, and teams that need guardrails across several infrastructure formats. Its provider coverage includes Terraform plans, Infracost, Kubernetes, CloudFormation, and JSON, with an extensible architecture for custom providers. Built-in evaluators include equality, containment, and regular-expression matching.

The main strength is breadth across a policy pipeline without requiring separate policy definitions for every supported input type. Tirith can lint and format policy files, produce JSON results for downstream processing, and return failure codes suitable for stopping non-compliant infrastructure changes. Its integrations include GitHub Actions and GitLab CI, while container-based CI integration is also supported. That combination makes it a practical fit for teams that want policy checks embedded in existing delivery workflows rather than a standalone governance interface. The JSON policy format is direct, but teams looking for a specialized policy language may prefer a different tool.

Tirith is open source and has a free plan, so its published model suits teams that want to inspect or extend a policy framework without adopting a paid tier. The project is distributed from its GitHub repository. It is strongest as a multi-format evaluation and CI component, with useful reporting and policy-testing capabilities. Teams that need simple, portable checks across infrastructure plans and configuration files should consider it. Teams primarily seeking deeper runtime enforcement or a broader operational control plane should look for an alternative with stronger verified capabilities in those areas.

Tirith pros and cons

• Where it wins
  • Supports Terraform, Infracost, Kubernetes, CloudFormation, and JSON inputs
  • Open-source CLI with JSON policies, linting, formatting, and pipeline output
  • Custom providers plus GitHub Actions and container-based CI integration
• Where it doesn't
  • Policy definitions use JSON rather than a purpose-built policy language
  • Runtime enforcement capabilities are narrower than its input and CI coverage
  • Distributed through GitHub rather than PyPI

Tirith fact sheet, pricing and score →

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated 7 Oct 2026 · How we research and update