Tork CLI Tool

Security Scanning

Detect vulnerabilities in configs

Policy Validation

Validate governance policies

Multiple Formats

Text, JSON, SARIF output

CI/CD Ready

GitHub Actions, GitLab CI

# Install from PyPI
pip install tork-governance

# Verify installation
tork version

Options

# Validate policies in a directory
tork policy --policy ./policies/

# Validate with verbose output
tork policy --policy ./policies/ --verbose

# Example output:
# Tork Policy Validator
# Validating policies at: ./policies/
# Loaded 5 policies

# Initialize policy directory with templates
tork init

# Specify custom output directory
tork init --output ./my-policies/

# Creates directory structure:
# ./policies/
#   └── (add your YAML policy files here)

# Using the Python SDK to evaluate content
from tork.core.engine import GovernanceEngine
from tork.core.models import EvaluationRequest

# Initialize engine with API key
engine = GovernanceEngine(api_key="your_tork_api_key")

# Evaluate content
request = EvaluationRequest(
    agent_id="my-agent",
    action="user_input",
    payload={"content": "My email is user@example.com"}
)

result = engine.evaluate(request)

print(f"Decision: {result.decision}")      # ALLOW, DENY, or REDACT
print(f"Violations: {result.violations}")  # List of policy violations
print(f"Modified: {result.modified_payload}")  # Redacted content if applicable

from tork.scanner import MCPScanner, SecurityRule, ScanSeverity, ScanFinding
import re

# Define a custom security rule
class CustomAPIKeyRule(SecurityRule):
    """Detect exposed API keys in configuration files."""

    id = "CUSTOM001"
    severity = ScanSeverity.CRITICAL
    title = "Exposed API Key"
    description = "API key found in configuration file"
    recommendation = "Move API keys to environment variables or secrets manager"

    # Pattern to match common API key formats
    API_KEY_PATTERN = re.compile(
        r'(api[_-]?key|apikey|secret[_-]?key|auth[_-]?token)["'\s]*[:=]["'\s]*([a-zA-Z0-9_-]{20,})',
        re.IGNORECASE
    )

    def check(self, file_path: str, content: str) -> list[ScanFinding]:
        findings = []

        for i, line in enumerate(content.split("\n"), 1):
            if self.API_KEY_PATTERN.search(line):
                findings.append(ScanFinding(
                    rule_id=self.id,
                    severity=self.severity,
                    title=self.title,
                    description=f"Potential API key exposed in configuration",
                    file_path=file_path,
                    line_number=i,
                    recommendation=self.recommendation,
                ))

        return findings

# Use custom rules with scanner
from tork.scanner.mcp_rules import get_all_mcp_rules

custom_rules = get_all_mcp_rules() + [CustomAPIKeyRule()]
scanner = MCPScanner(rules=custom_rules)

result = scanner.scan_directory("./config/")