Past event · Aug 24, 2026
Trustabl contribution guide
Trustabl is an agent-security scanner. The highest-leverage contribution path is new detection rules — YAML definitions, threat-model docs, and test fixtures across three repos. This page archives the guide from the August 24 in-person hackathon. The repositories are still open for remote contributions.
Monday, August 24, 2026 · afternoon
Hult International Business School, 1 Education St, Cambridge, MA
The in-person session has ended. The Luma page is the event record. Remote contributions do not need campus registration.
Event record on Luma →Main repositories
- trustabl/trustabl — Core scanner (Go)
- trustabl/trustabl-rules — Detection rule packs (YAML)
- trustabl/trustabl-rulebook — Threat model / rationale docs
Primary contribution path: new rules
Most accessible and highest impact. A single rule lives across three repos.
- YAML definition in trustabl-rules under the correct SDK directory (claude_sdk/, openai_sdk/, google_adk/, mcp/, langchain/, etc.)
- Rationale / threat-model doc in trustabl-rulebook (use the template in docs/policy-rationale-doc-template-guide.md)
- Fire + silent test cases in the engine's testdata/rules-fixture/
Key conventions are documented in trustabl-rules/CLAUDE.md — required fields, ID scheme, severity/confidence guidance, applies_to scopes. After writing the YAML, run trustabl rules validate and the engine's Go tests. trustabl-rules/CLAUDE.md. Rationale template: policy-rationale-doc-template-guide.md.
Other contribution areas
- Engine improvements (Go; CGO required for tree-sitter)
- GitHub Action (trustabl-action)
- Cursor / VS Code extensions
- Documentation and example agent repos
Highest-value target areas right now
- Deeper coverage for LangChain/LangGraph, CrewAI, AutoGen/AG2, Pydantic AI, and Vercel AI SDK (Claude, OpenAI, Google ADK, and MCP currently have the strongest rule sets)
- Completing the missing rationale docs for the 14 shipped MCP rules
- New rules around error handling, idempotency, observability/tracing, approvals, and shell/network safety
- Expanding language support beyond the current Python + TypeScript focus
- Real-world agent templates that surface new failure modes
How to start
- Join the Discord
- Fork the relevant repo(s)
- Open a PR (small, focused PRs preferred)
- For rules, follow the three-repo process above
Rule authoring and rationale docs were the highest-leverage way to contribute in that session, and they are still the best place to start a remote pull request.