Stroq

Why it's ranked here

The distinctive idea is provenance: judging a command by where it came from rather than by how it looks, since a malicious package install and a legitimate one are the same text. The default policy denies outbound use of any known credential value whatever the session state, and the project gates its own CI on a mutation fuzzer with a baseline of zero escapes. It is Apache 2.0, pre-1.0, and publishes a false-positive rate of 14.9% on 121 benign READMEs rather than claiming none. That candour, plus adapters for seven agents and an MCP proxy, makes it one of the more serious agent guardrails available.

What's good

Secrets are indexed as salted SHA-256 hashes, never stored in the clear, and the index ignores any credential file over 256 KB and keeps at most 2,000 entries. The attack command replays 21 scenarios, twelve drawn from public incidents such as the Sentry agentjacking and s1ngularity attacks, and exits nonzero if any one gets through, so a weakened policy fails a pipeline. The coverage report maps those scenarios to MITRE ATLAS techniques and marks most as not covered, with a stated limit for each. CI runs the suite on Linux, macOS and Windows and replays a demo for every agent adapter.

Tradeoffs

Five risky action classes, including network commands, reading secret files and pushing to external remotes, are allowed in a clean session and blocked only after a scan flags something, a choice the default policy explains in writing. Roughly one benign README in seven still trips a rule. The security policy lists known gaps: shell evasions built from quote splicing, patches whose text is never scanned, and a Windsurf hook that cannot see command output. Windows gets weaker file-permission guarantees. The optional MCP value-masking mode keeps a reversible dictionary of real values on disk. The docs disagree with themselves on small counts, such as how many synthetic scenarios exist.

How to use it well

Run the look-back report first: it needs no install and tells you whether credentials have already reached a provider. Then install the hooks for your agent and run the attack replay against your own policy in CI, so any loosening fails a build. Teams with many MCP servers can put the proxy in front of any client that launches local servers. Expect to clear a false-positive taint by hand now and then. For filesystem isolation, the launcher can wrap the agent in Anthropic's sandbox runtime when it is installed. It does not see injections typed straight into the chat.

Observed

License

Apache-2.0 (LICENSE, package.json)

Language

TypeScript, requires Node.js 22 or later

Packaging

npm package @stroq/cli, runnable through npx without installing

Interfaces

CLI with per-agent hook entrypoints, plus a stdio MCP proxy

Agent support

Hooks for Claude Code, Cursor, Codex, Copilot CLI, Windsurf and Antigravity; a plugin for OpenClaw

Platform support

CI runs the test suite on Linux, macOS and Windows (.github/workflows/ci.yml)

Runtime dependencies

yaml and zod only (packages/cli/package.json)

Maturity

Pre-1.0; only the newest npm release is supported (SECURITY.md)

Network behaviour

README states the hooks make no network calls and send no telemetry