no — deterministic offline scan; enrich uses your own key; telemetry opt-in
Yes. OpenShell and Trustabl address different layers. OpenShell helps isolate the runtime; Trustabl’s analyzer checks agent code and configuration for reliability and safety issues before deployment. Automated OpenShell policy generation is planned for Trustabl Console, not part of the open-source scanner today.
First run trustabl scan . --format json > scan.json. Then run trustabl enrich --input scan.json --repo . --diff --apply with your own Anthropic, OpenAI, or Google key. Trustabl displays the proposed patch, confirms that the current file still matches the scanned version, and writes a .trustabl.bak backup before applying a fix. If the file changed after the scan, Trustabl skips the stale fix instead of applying it.
Not for scanning. The analyzer is read-only and reports findings without changing your files. If you use trustabl enrich, it proposes a patch for review and only applies it when you choose --apply; it also creates a .trustabl.bak backup and skips stale fixes when the file has changed since the scan.
