Stroq

Stroq is an open-source action firewall for AI coding agents. It watches what an agent reads, records where actionable instructions came from, and evaluates later tool calls against a local policy before they run. The problem it addresses is indirect prompt injection. An agent can encounter hidden or persuasive instructions in a repository file, web response, command output, or MCP result, then carry those instructions into a network request, destructive shell command, credential read, external push, or configuration change. Stroq adds a deterministic enforcement layer at the agent's tool hooks so the decision doesn't depend only on the model recognizing that the content was untrusted.

The engine works in two phases that map onto each supported host's events. After a read or tool result, it normalizes the returned text, scans it with its rule sets, records provenance, and can mark the current session as suspect. Before a later action, it classifies the tool call and applies an ordered YAML policy in which the first matching rule wins. The policy can allow the action, ask the user, or deny it. Session taint carries context from the suspicious read into that decision. This lets Stroq treat a command copied from a flagged page differently from the same text entered independently, and it can explain the evidence behind a denial with the stroq why command. A custom policy replaces the default policy, so teams need to carry over any provenance and secret rules they still expect to enforce.

Stroq runs locally without sending policy decisions through a cloud service. It installs native hooks for Claude Code, Cursor, Codex, Copilot CLI, and Windsurf, plus an in-process OpenClaw plugin and a standard input and output proxy for MCP clients. One engine, policy file, taint store, and audit log serve those adapters, though the exact coverage depends on which events each host exposes. Installation uses the @stroq/cli npm package, with agent-specific flags when needed, and a dry-run option can preview configuration changes. The doctor command checks the runtime, rules, hooks, and a self-test after installation. Project-level or user-level hook installation is available for several adapters, and repeating initialization is designed to update Stroq's entry without removing unrelated hooks.

Beyond prompt-injection rules, the firewall has a secret egress guard. It indexes values from project environment files, common credential files, and credential-shaped environment variables as salted hashes. Outbound actions whose arguments contain one of those values can be denied without writing the secret itself into the reason or audit log. Canary values can be planted to test the path. Decisions are appended to a hash-chained JSONL audit file, and a separate verify command checks the chain for tampering. Stroq also protects its own policy and agent hook configuration from changes made by a tainted session, while a user can clear a false positive with an explicit untaint command. Large outbound arguments that exceed the documented scan window are denied as unscannable instead of being checked only in part.

The project includes an attack replay command with recorded hook events modeled on public incidents and one additional bypass class. It runs them against the active policy in throwaway directories and reports which cases were blocked, asked, or allowed. This is useful for checking whether a customized policy quietly weakened a defense. Rules are normalized before matching, including handling for hidden characters, homoglyphs, and encoded content. The project says its hand-written and vendored rules go through benign-corpus and regex performance gates. Even with that testing, no static scanner eliminates false positives or every novel injection, so policy review and ordinary agent permissions still matter.

Stroq is best suited to developers and security teams that run capable coding agents locally and want an enforceable control between model intent and tool execution. Its strongest fit is a workflow that uses supported hooks and is comfortable maintaining a security policy. Coverage is not identical everywhere. The project documents that Cursor can't block editor writes through its current integration, some hosts don't expose their own web reads, and an ask decision may be rendered as a denial where the client lacks interactive approval. It also notes host-specific fail behavior when hooks cannot start. The software is available under the Apache License 2.0 and has no hosted paid tier in the official material reviewed. Setup is concise, but effective deployment still requires reading the adapter limits and testing the actual policy against the team's workflows.