read_file is the whole mechanism: the context is injected before the code is seen, which is earlier than a review and earlier than a test. What keeps it auditable rather than opaque is explain, which renders exactly what would be injected for a path including the dependencies and the entries that were suppressed, and check_tripwires, which answers the same question without opening the file at all. Retiring a rule is a soft disable that sets active: false and leaves the YAML in place, so the reason it existed outlives the decision to stop firing it.
A project-local safety-note system: tripwires stored as YAML and matched to paths, injected into file reads, with tools to preview what would fire and why.
- read_file, which reads a file with the matching tripwire context injected, in place of a raw read.
- create_tripwire, which records a new one with its triggers, severity, tags, context and what it was learned from.
- list_tripwires filtered by path, tag or severity, and deactivate_tripwire, which sets active: false in the YAML rather than deleting the file.
- check_tripwires, which previews what would fire for a path without reading the file, and explain, which shows the matched tripwires, their dependencies, the suppressed entries and the rendered injection.
- Project navigation relative to the project root: list_directory, file_stat for type, size and modified and created times, and search_files by glob pattern.
Nothing to supply — no account, no key. A project root, since paths and glob searches are resolved relative to it, and the YAML files the tripwires live in.
One command — npx -y @tripwire-mcp/tripwire serve --project .