Firedrill

Firedrill Your rules, drilled weekly, with proof.

It runs your company's safeguards as drills against the real systems and returns PASS or FAIL with evidence.

brew
brew install sk1122/tap/firedrill
go
go install github.com/sk1122/firedrill/cmd/firedrill@latest

GitHubApache-2.0. macOS, Linux and Windows.

A card from the board firedrill report writes. Example data.

A drill is one rule you can run

A drill is a short YAML file: the facts it reads, and the conditions that must hold, written in CEL. This one is in the agent pack, copied as it ships.

packs/agent/no-prod-secrets-in-agent-reach.drill.yaml
firedrill: v0
id: agent/no-prod-secrets-in-agent-reach
safeguard: "No production or unclassified credential sits in a file a coding agent can read."
severity: critical
for_each: repos
fetch:
  secrets: { fact: files.secrets }
  agents:  { fact: files.agent_configs }
pass_when:
  - secrets.found.filter(s, s.agent_readable && s.env_class in ["prod", "unknown"]).size() == 0
fix: "Rotate the credential, move it to a secret manager, and treat a token with no readable scope as full access."
maps_to: [SOC2:CC6.1]
terminaltrimmed to this drill
$ firedrill run --path api
FAIL  agent/no-prod-secrets-in-agent-reach  api  1 failing, first: unknown credential in scripts/deploy.sh

Needs attention: 1 newly open, 0 closed
next: fix, then  firedrill verify agent/no-prod-secrets-in-agent-reach

$ firedrill verify agent/no-prod-secrets-in-agent-reach --path api
PASS  agent/no-prod-secrets-in-agent-reach  api

Needs attention: 0 newly open, 1 closed

CLOSED  agent/no-prod-secrets-in-agent-reach

The run exits 1 when an unwaived critical or high safeguard opens, so CI can stop on it. A ticket saying "fixed" changes nothing. Only a passing run closes it.

Three promises

  1. It only reads

    Every connector asks for read access, and a guard refuses anything else.

  2. It stays with you

    No telemetry, no model, no server, and credentials stay on the machine or CI that runs it.

  3. It keeps proof

    Every result is a hash-chained record with the evidence that decided it, and a failure stays open until a run passes.

38 drills in ten packs

Each drill names one safeguard in a sentence and checks it against GitHub, Google Workspace, Google Cloud, AWS, your repos, DNS and the public web. A drill whose system isn't connected waits, and the run says what connects it.

Agent

8 drills

What your coding agents can read, run and reach: the files, keys and MCP servers they work with, and the settings that limit them.

  • No production or unclassified credential sits in a file a coding agent can read.agent/no-prod-secrets-in-agent-reach
  • A coding agent never works through a human's credentials that can skip review.agent/agent-has-own-identity
  • Committed agent settings require approval for destructive commands.agent/destructive-commands-gated
  • Every MCP server points at an owned or allowlisted host, and any package it runs is pinned.agent/mcp-servers-known
  • No secret sits in an agent's config files, and local agent settings are gitignored.agent/no-secrets-in-agent-config
  • Each coding agent's committed settings restrict outbound network access to an allowlist.agent/egress-allowlisted
  • AWS keys within an agent's reach cannot delete or run as admin.agent/no-destructive-tokens
  • Each agent and MCP server has its own credential.agent/no-shared-agent-keys

  • Change 8 drills

    Nobody merges and deploys to production alone. History on main can't be rewritten. CI reaches the cloud through OIDC, never a stored key.

  • Doors 7 drills

    No DNS record points at a deleted host. No public source maps or API docs. No key in public JavaScript matches a live cloud key.

  • Access 6 drills

    Every admin has MFA enforced. People who left hold nothing in Google Workspace, GCP or GitHub. No admin sits unused for 90 days.

  • GCP 3 drills

    No public buckets. Only your own domains hold Owner. No service account key is older than 90 days.

  • Recovery 2 drills

    Production databases keep backups with a copy in another account or project, and a restore has succeeded recently.

  • Paths 1 drill

    No one person can both skip review on a repo that deploys to production and destroy production data.

  • Supply 1 drill

    JavaScript projects commit their lockfile, CI installs from it unchanged, and no dependency quietly gains an install script.

  • Keys 1 drill

    Every Anthropic and OpenAI API key has an owner and sits under a hard spend limit.

  • Code 1 drill

    Your own Semgrep rules report nothing at error level.

More drills, each with passing, failing and not-applicable test cases, are in the Drill Hub. firedrill hub add copies one into your repo as a file you review.

Who can reach what, and what changed

Firedrill joins what it reads into one graph of people, agents, credentials and production. The board draws one question at a time from it.

Who can reach production data alone?
Every person who can get from code to production without a second human, drawn as paths.
What can this agent touch?
The secrets an agent config can read, the keys behind them, and what those keys can do, where the key is in the cloud inventory.
What changed since last week?
Each run compares itself with the previous one and lists weakenings first: a new admin, a new bypass, a new deploy path, a secret in a new place.

People appear as short hashed IDs, never ranked. Only settings are compared, never timestamps, and a system not read in both runs is left out and named.

Example graph: who can reach production Person 3f9a2c71 newly gained a bypass on repo acme/api, which deploys to the production environment, and also holds owner on the GCP project acme-prod. Person b71d5e09 can push to acme/api. An agent config in acme/api can read secret 9c1e04ab, a key that can delete in acme-prod. PEOPLE AND AGENTS ACCESS PRODUCTION new: bypass deploys to can read can delete person 3f9a2c71 person b71d5e09 agent config .claude/settings.json repo acme/api owner on acme-prod secret 9c1e04ab in acme/api env production GCP project acme-prod

personfiles and agentsGitHubGCPnew since last run

$ firedrill diff
CHANGES  2026-11-02 06:00 UTC to 2026-11-09 06:00 UTC · 1 weakening, 0 other

Weakenings (1)
  New bypass actor (1)
    person 3f9a2c71 can now bypass review on repo acme/api
Example data, drawn the way the board's graph pages draw it: people and agents on the left, production on the right, new edges in red.

A fire drill doesn't ask whether the building is safe. It pulls the alarm and watches what happens.

Firedrill does that for the rules your company believes it follows. AI made claims nearly free: code, approvals, "done" statuses, compliance answers. Proof stayed expensive. Existing tools check pieces. Firedrill starts from your own rules, keeps a record of each one over time, and checks what AI agents can reach.

April 2026

An agent found a cloud token and deleted production

A coding agent working on a staging task used a cloud token it found in an unrelated file and deleted a company's production database, with its backups, in seconds.

The drill for it: agent/no-prod-secrets-in-agent-reach

August 2026

An agent pushed a mass deletion to main

An agent pushed a commit deleting 723 files to main in one repo and 151 in another. Main was unprotected, and the agent used a human's credentials.

The drills for it: agent/agent-has-own-identity and change/human-review-required

Five minutes to the first failure

Keep Firedrill in its own private repo, because records hold account names and failing settings. If the GitHub CLI is logged in, connect github reuses its login.

  1. Set up the repo
    firedrill init --org acme --repos api,web,infra --owner @arjun
  2. Connect GitHub
    firedrill connect github
  3. Run every drill
    firedrill run
  4. Fix, then prove it
    firedrill verify change/no-solo-ship

Then run it weekly in CI with the workflow file: one issue per newly open safeguard, assigned to its owner, closed when a run passes.