Repolode
Submit
AGGIB

AGGIB/Stroq

A local security tool that scans your AI coding agent sessions for leaked secrets and hooks into Claude Code, Cursor and Codex to block or question risky commands.

View on GitHubWebsite
Stars
202
Forks
15
Open issues
7
Last commit
7 hours ago

What is it?

Stroq is a local security tool for AI coding agents such as Claude Code, Cursor and Codex CLI. It reads your existing agent session records and reports which commands came from text the agent had read, and which credentials were passed to outside services. It prints key names and sources, never the values.

Its hooks evaluate each tool call before it runs. They can deny commands like piping a download into a shell, or outbound requests that carry a known secret, and they ask for confirmation when a command repeats text the agent read. A local console on 127.0.0.1 shows recorded decisions, which agents are connected, and the skills and MCP servers each agent uses. Stroq is run with npx and needs Node.js 22 or newer; it sends no telemetry.

The project also includes a replay command that checks past sessions against the current policy, and an attack command that runs a set of known attack cases in a throwaway environment.

Key features

  • 01Scans agent session records for known secrets and reports key names and sources without showing values.
  • 02Installs hooks for Claude Code, Cursor and Codex that deny risky outbound calls and ask before reusing text the agent read.
  • 03Replays past sessions against the current policy without running any commands.
  • 04Provides a local console on 127.0.0.1 to review decisions, connected agents and MCP servers.
  • 05Runs entirely locally with no account and no telemetry.

Use cases

  • Checking whether API keys or cloud credentials were sent out by an AI agent during past coding sessions.
  • Adding guard rails so an agent cannot pipe downloaded scripts into a shell or leak secrets over curl.
  • Auditing which skills and MCP servers your coding agents have loaded and what changed since last review.

Quick start

  1. 1

    Run Stroq with npx to see a card of your own sessions

    npx @stroq/cli
  2. 2

    Guard your agent by hooking Stroq into it

    npx @stroq/cli init
  3. 3

    Open the local console on 127.0.0.1

    npx @stroq/cli console

Things to know

  • Needs Node.js 22 or newer.
  • Adding hooks from the console needs macOS or Linux; on Windows use stroq init.
  • It is a filter, not a sandbox, and a hook sees only what the host sends it.
  • Hooks support varies by agent and version, so read the integration limits before relying on a live hook.

In collections

Claude Code tools, skills & pluginsOpen-source AI agent frameworks & appsAI coding assistants & agents

Topics

#agent-security#ai-agents#secret-scanning#prompt-injection#claude-code#cursor#codex#developer-tools#ai-security#coding-agents

FAQ

What is Stroq?
A local security tool that scans your AI coding agent sessions for leaked secrets and hooks into Claude Code, Cursor and Codex to block or question risky commands. Stroq is a local security tool for AI coding agents such as Claude Code, Cursor and Codex CLI. It reads your existing agent session records and reports which commands came from text the agent had read, and which credentials were passed to outside services. It prints key names and sources, never the values.
Is Stroq free to use? What license does it have?
Stroq is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
Is Stroq still maintained?
Actively maintained. The last commit to Stroq was on Nov 7, 2026.
What can I use Stroq for?
Checking whether API keys or cloud credentials were sent out by an AI agent during past coding sessions. Adding guard rails so an agent cannot pipe downloaded scripts into a shell or leak secrets over curl. Auditing which skills and MCP servers your coding agents have loaded and what changed since last review.
How do I install Stroq?
Run Stroq with npx to see a card of your own sessions: npx @stroq/cli Guard your agent by hooking Stroq into it: npx @stroq/cli init Open the local console on 127.0.0.1: npx @stroq/cli console
Where can I get Stroq?
The source code and installation instructions are on GitHub: https://github.com/AGGIB/Stroq

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects