pipelab-org/pipelock

What is it?

Key features

• 01Scans HTTP, WebSocket, MCP and A2A traffic for secret leaks, prompt injection and SSRF.
• 02Emits signed action receipts that can be verified offline with a public key.
• 03Wraps MCP servers over stdio or Streamable HTTP and scans tool descriptions and responses.
• 04Provides DLP patterns, entropy analysis and request redaction for secrets.
• 05Runs agents in an OS-level sandbox on Linux (Landlock, namespaces) and macOS (sandbox-exec).
• 06Includes a kill switch, flight recorder, scan API and SIEM event forwarding.

Use cases

• Stopping a coding agent that has API keys in its environment from sending them to external URLs.
• Restricting an agent to an allowlist of domains in regulated or high-security environments.
• Auditing MCP tool calls and producing verifiable evidence of what the boundary allowed or blocked.
• Evaluating agent egress policy in audit mode before enforcing it.

Quick start

1. 1

   Clone the v3.7.0 source

   git clone --branch v3.7.0 --depth 1 https://github.com/pipelab-org/pipelock.git
2. 2

   Build and install from source (Go 1.26+)

   make -C pipelock install
3. 3

   Generate a config file

   pipelock init --output ./pipelock.yaml
4. 4

   Test the scanner on an allowed URL

   pipelock check --config ./pipelock.yaml --url "https://docs.python.org/3/"

Things to know

• !Source builds from make install are Community-only; paid-tier features need a license key in release binaries.
• !Enterprise features such as the operator dashboard require a paid license.
• !The demo's signing key is ephemeral, and the operator holds the signing key, so receipts do not prove operator honesty.

In collections

Topics

FAQ

What is pipelock?

Open-source AI agent firewall that sits between agents and the network to block secret exfiltration, prompt injection, SSRF and MCP tool poisoning, with signed action receipts. Pipelock is a proxy that sits between AI agents and the network. It inspects HTTP, WebSocket, MCP and A2A traffic, and CONNECT tunnel contents when TLS interception is enabled, looking for secret exfiltration, prompt injection, SSRF, tool poisoning and risky tool-call chains. It runs in strict, balanced or audit modes, with strict allowing only allowlisted domains.

Is pipelock free to use? What license does it have?

pipelock is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.

Is pipelock still maintained?

Actively maintained. The last commit to pipelock was on Nov 6, 2026.

What can I use pipelock for?

Stopping a coding agent that has API keys in its environment from sending them to external URLs. Restricting an agent to an allowlist of domains in regulated or high-security environments. Auditing MCP tool calls and producing verifiable evidence of what the boundary allowed or blocked. Evaluating agent egress policy in audit mode before enforcing it.

How do I install pipelock?

Clone the v3.7.0 source: git clone --branch v3.7.0 --depth 1 https://github.com/pipelab-org/pipelock.git Build and install from source (Go 1.26+): make -C pipelock install Generate a config file: pipelock init --output ./pipelock.yaml Test the scanner on an allowed URL: pipelock check --config ./pipelock.yaml --url "https://docs.python.org/3/"

Where can I get pipelock?

The source code and installation instructions are on GitHub: https://github.com/pipelab-org/pipelock