Stroq

Stroq is an open-source, local action firewall for AI coding agents, published under the Apache-2.0 license. It installs as native hooks in Claude Code, Cursor, Codex, Copilot CLI, and Windsurf, as an in-process plugin in OpenClaw, and as a stdio proxy for any other MCP client. The core idea is deterministic, local enforcement: no cloud round trip, no proxy, and no relying on the model to notice a prompt injection.

What It Is

Stroq sits on an agent's own tool-call hooks and enforces a policy on every action the agent tries to take. It operates in two phases: a PostToolUse scan that reads everything the agent reads (files, web pages, MCP results, command output) and taints the session when suspicious content is found, and a PreToolUse classifier that evaluates the next action against an ordered YAML policy that knows the session's taint. The result is either deny, ask, or allow — and every decision is appended to a hash-chained, tamper-evident audit log.

How the Two-Hook Architecture Works

The engine normalizes all content before scanning — stripping zero-width and tag characters, folding homoglyphs, and decoding base64, hex, and URL encodings up to two levels deep — so a command hidden in an encoding is matched like the plain text it decodes to. Normalized content is then matched against 599 gated rules (12 hand-written Stroq rules plus 596 vendored Agent Threat Rules from the MIT-licensed ATR project). If the highest-severity match scores at or above the configurable threshold (0.6 by default), the session is marked suspect and the agent receives an inline warning.

On the action side, Stroq classifies tool calls into fourteen action classes — shell.network, fs.secrets, git.push_external, shell.exec_encoded, config.self, mcp.side_effect, and more — and evaluates them against an ordered policy where the first matching rule wins. The default policy always denies secret egress, self-tampering, encoded execution, and actions dictated by flagged content; tainted sessions get additional denials on network, fetch, secret, and external-push actions; destructive commands and commands copied from tool output always ask.

Provenance and Secret Egress Guard

Two capabilities go beyond rule matching. Provenance tracks where instructions came from: every scanned tool output leaves a bounded, redacted trace of its actionable atoms (package names, curl | sh lines, base64 blobs, URLs). When a later command contains one of those atoms, the decision carries the evidence — an npx package that appeared in an MCP result 40 seconds ago is asked about with its source named. Secret egress indexes the values of secrets on disk (.env* files, ~/.aws/credentials, ~/.npmrc, ~/.netrc, ~/.docker/config.json, and credential-shaped environment variables) as salted hashes. An outbound call carrying one of those values is denied, naming the variable and the file but never the value itself. The whole argument is scanned in overlapping windows up to 2 MiB; anything larger is denied as unscannable rather than forwarded half-checked.

Agent Coverage and Deployment

Stroq installs with a single npx @stroq/cli init command and requires Node 22 or newer. Each agent gets its own install path:

• Claude Code — .claude/settings.json hooks or the plugin marketplace
• Cursor — .cursor/hooks.json with failClosed on the two blocking events
• Codex — .codex/hooks.json
• Copilot CLI — .github/hooks/stroq.json
• Windsurf — .windsurf/hooks.json across six Cascade events
• OpenClaw — in-process plugin at priority 100
• Any MCP client — stroq mcp stdio proxy wrapping each server entry

One policy file, one taint store, and one audit log govern all adapters. The coverage table on the project site documents what each host lets Stroq stop, including known limits such as Cursor's lack of a blocking edit hook in v1 and Codex's inability to prompt (ask becomes deny).

Update: v0.10.1

The latest release is v0.10.1 ("Attack corpus out of the JS bundle"), published on 2026-09-09. The project reached v0.10.0 with the secret scan window feature, which reads the whole argument in overlapping windows up to 2 MiB and denies what it cannot scan instead of forwarding it half-checked. The roadmap lists upcoming work including a local daemon with an ONNX-based classifier to replace per-invocation Node startup, Cursor's generic preToolUse hook for blocking editor writes, directory-level self-tamper detection, and a team control plane for shared policy and fleet-wide audit.

Why It Matters for Agent Security

The project cites published research to motivate its design. According to Tenet Security (June 2026), fake Sentry errors delivered over MCP achieved an 85% success rate at getting Claude Code, Cursor, and Codex to run an attacker's npx package. Rehberger (August 2026) found that prompt injection bypassed Claude Code's auto-mode classifier in 60–80% of attempts. Anthropic's own engineering blog (August 2026) measured that 97% of permission prompts are approved. Stroq's stroq attack command replays thirteen recorded incidents — including Sentry agentjacking, s1ngularity, RoguePilot, Comment-and-Control, ToxicSkills, and others — through the user's own policy, reporting blocked/asked/passed per scenario and exiting with code 1 if anything gets through, making it usable as a CI acceptance test for the default policy.