Back home

Stroq

x+web 0.68
Visit source

Intro

Stroq is developer Agybay (AGGIB)'s local open-source coding-agent firewall / audit tool: deterministic policy gates before Claude Code, Codex, Cursor, Copilot CLI, Windsurf, Antigravity and similar agents act — focused on secret egress and dangerous actions driven by untrusted-origin instructions. Site: https://stroq.dev/ ; CLI: npx @stroq/cli; source https://github.com/AGGIB/Stroq (Apache-2.0). 0.30.0 shipped 2026-11-05 and was flagged in Austen Allred's Last 24 Hours in AI.

Core (official):

  • PreToolUse hooks: normalize (strip zero-width, fold homoglyphs, decode base64/hex/URL two levels) → provenance (name which earlier tool output tainted a later action) → secret egress guard (salted-hash secret index; outbound carrying a secret is denied with variable/file names — never the value);
  • Default policy ~21 rules / 19 action classes (secret.egress, origin.suspect, shell.exec_encoded, …);
  • stroq attack replays 36 public/authored incidents against your policy (vendor: 15 blocked, 21 asked, 0 through);
  • Local console via npx @stroq/cli console (loopback only; no account/telemetry);
  • Shared team policy / SSO marked as coming soon.

Explain

Why it matters

Agentjacking / prompt injection ends in actions. Guards that only judge the command string miss "the issue/README two steps ago named the package". Stroq puts provenance + secret egress into deterministic PreToolUse policy (no model in the loop; no network on the hook hot path).

Honest limit

Vendor note: the content scan is regex over normalized text and is bypassable by construction, which is why enforcement sits at the action. Remaining gaps are documented. Destructive commands often ask rather than hard-block.

Limits

  • Needs hook support and a correct init; "connected" ≠ every action covered;
  • Attack replay tests the policy, not a live agent;
  • Solo-maintained; team features still on the roadmap.

Usage

Who it's for

  • Developers running Claude Code / Codex / Cursor agents on real repos who worry about secrets and poisoned instructions;
  • Security engineering that wants a replayable attack set and local audit journals;
  • Teams adding deterministic PreToolUse gates (start solo if needed).

Getting started

  1. Node 22+; in-project npx @stroq/cli init then doctor (--dry-run to preview);
  2. Pick the agent: --agent cursor|codex|copilot|windsurf|antigravity|…;
  3. Copy/edit ~/.stroq/policy.yaml; regress with stroq attack;
  4. Open npx @stroq/cli console for live audit; restart the agent after hook changes.

Advertisement