luckyPipewrench/pipelock

Pipelock sits between AI agents and the network. It inspects mediated HTTP, WebSocket, MCP, and A2A traffic, plus CONNECT tunnel contents when TLS interception is enabled, for secret exfiltration, prompt injection, SSRF, tool poisoning, and risky tool-call chains. Plain CONNECT without interception is scanned at the hostname and URL level. Configured MCP upstreams are an exception to private-address SSRF blocking: local/private servers are allowed, but cloud metadata endpoints remain blocked.
Pipelock emits mediator-signed action receipts over content-aware boundary decisions, so a reviewer can verify what Pipelock decided outside the agent runtime. The public agent-egress-bench corpus exercises the detections. The Gauntlet workflow is the product's scheduled candidate exam against a pinned corpus commit; it does not auto-publish a public score. Learn more: Open-source AI firewall.
**Works with:** Claude Code · OpenAI Codex · Cline · OpenCode · Pi · Zed · Cursor · VS Code · JetBrains · OpenAI Agents SDK · Google ADK · AutoGen · CrewAI · LangGraph
Problem ·
Verify ·
Quick Start ·
Action ·
Catches ·
Features ·
Architecture ·
Docs ·
Playground ·
Blog ·
Ask Dosu
Try it in your browser at the live playground . If Pipelock earns it, star the repo so other people find it.
---
The Problem
Your AI agent has $PROVIDER_API_KEY in its environment, plus shell access. One request can leak it:
Every machine action your agent takes should cross a boundary between your secrets and the open internet. Pipelock becomes that boundary when the agent is routed through its proxy, MCP wrapper, sandbox, host containment model, or cluster deployment topology. It scans mediated outbound and inbound traffic, blocks or flags attacks based on mode, and records signed evidence of the decision.
---
Verify It Yourself
Most agent-security tools ask you to trust their dashboard. Pipelock hands you a signed receipt and lets you check it yourself, offline, with a key you hold. No account and no server.
The built-in demo fires real attack scenarios, blocks them, and writes signed receipts plus the public key to disk with no config and no network:
The scorecard grades each claim on its own and states what it does not prove: whether anything happened outside the boundary Pipelock mediates. Below it, the receipt timeline lists the recorded mediated decisions with their verdicts and hash links. A receipt that is honest about its own limits beats a green checkmark that hides them.
The evidence viewer is free and needs no license. It reads a flight-recorder
session, which is what Pipelock writes while it runs, rather than the demo
receipts above:
Two honesty notes, stated up front. The demo signs with an ephemeral key it prints for the run, which proves the receipts are self-consistent rather than tied to a named identity. The public Pipelock playground is a separate path that verifies against a key Pipelock publishes. And the operator running Pipelock holds the signing key, so a receipt proves what the boundary decided and that the key holder signed it, not that the operator is honest. pipelock anchor receipts records receipt-chain checkpoints to a local backend or a Rekor transparency log for later audit, and operator-independent verification against that anchor is still being proven end to end.
The full argument for why proof beats promises is in demonstration over attestation.
---
Quick Start
These examples target v3.7.0 once its release artifacts are published. For an existing deployment, read the 3.7 upgrade guide before changing the binary or configuration.
Other install methods
Verify release integrity
Use GitHub CLI v2.97.0 or later for attestation verification; older versions have a signer-matching vulnerability.
Release workflows publish SLSA provenance, CycloneDX SBOMs, checksums, and signed container images, and (from 3.6.0) an attested Helm chart. Source builds made with make build or make install produce a Community-only binary; pre-built release artifacts include paid-tier code that activates with a valid license key.
---
See It In Action
The Pro/Enterprise operator dashboard (pipelock dashboard serve) is a read-only console over signed evidence. It supports token, OIDC, or mTLS authentication; bounded RBAC permissions; redacted metadata views; raw-view elevation; exemption lifecycle records; backup and restore; coverage certificates; and fleet views. It is present in enterprise-tagged builds and release artifacts with the required license feature.