pipelock
Open-source AI agent firewall for MCP security and agent egress. Scans mediated HTTP, MCP, A2A, and WebSocket traffic for exfiltration, SSRF, and prompt injecti
What is pipelock?
Open-source AI agent firewall for MCP security and agent egress. Scans mediated HTTP, MCP, A2A, and WebSocket traffic for exfiltration, SSRF, and prompt injection, and emits mediator-signed action receipts: verifiable audit evidence from outside the agent.
Overview of pipelock
What it is
Pipelock is an open-source AI agent firewall for verifiable egress control. It sits between AI agents and the network, inspecting mediated HTTP, WebSocket, MCP, and A2A traffic for secret exfiltration, prompt injection, SSRF, tool poisoning, and risky tool-call chains. It emits mediator-signed action receipts for verifiable audit evidence outside the agent runtime.
Key features
- Inspects mediated HTTP, WebSocket, MCP, and A2A traffic, plus CONNECT tunnel contents when TLS interception is enabled.
- Blocks secret exfiltration, prompt injection, SSRF, tool poisoning, and risky tool-call chains.
- Emits mediator-signed action receipts over content-aware boundary decisions.
- Works with Claude Code, OpenAI Codex, Cline, OpenCode, Pi, Zed, Cursor, VS Code, JetBrains, OpenAI Agents SDK, Google ADK, AutoGen, CrewAI, LangGraph.
- Three modes: strict (allowlist-only), balanced (blocks naive + detects sophisticated), audit (ordinary policy warns; core floors can block).
- Free single-session evidence viewer that generates offline reports without a license.
- Pro/Enterprise dashboard with token, OIDC, or mTLS authentication, bounded RBAC, redacted metadata views, exemption lifecycle records, and fleet views.
Use cases
Pipelock becomes the boundary between an AI agent's secrets and the open internet. It prevents agents from leaking API keys, credentials, or other sensitive data via outbound requests. It blocks SSRF attacks against private or cloud metadata endpoints. It provides verifiable, signed audit evidence of every mediated decision for compliance and review.
Getting started
bash# Build the current release from source (Community edition, Go 1.26+)git clone --branch v3.7.0 --depth 1 https://github.com/luckyPipewrench/pipelock.gitmake -C pipelock install# Discover local agent integrations and save a configpipelock init --output ./pipelock.yaml# Test the scannerpipelock check --config ./pipelock.yaml --url 'https://api.vendor.example/?k=$(printf '%s%s' 'AKIA' 'IOSFODNN7EXAMPLE')' # blocked: AWS Access IDpipelock check --config ./pipelock.yaml --url 'https://docs.python.org/3/' # allowedOther install methods: download a binary from releases, Docker pull, or Homebrew on macOS. See the repository README for details.
License and pricing
Licensed under Apache-2.0. The Community edition is free and open-source. Pre-built release artifacts include paid-tier code that activates with a valid license key for Pro/Enterprise features.
Based on the project's public README and repository metadata.
