Open-source agent firewall for MCP and AI agent egress
Pipelock mediates MCP, HTTP, and WebSocket traffic at the agent boundary, wraps stdio MCP servers, and emits signed action receipts any third party can verify offline when receipt signing is configured.
New to the category? What an agent firewall does and where its boundary stops.
Select a star for details.
Browse 27 demo receipts
813+
GitHub Stars
31,000+
Test Cases
>90%
Core Coverage
Go
Single Binary
242
Public Bench Cases
7
Compliance Mappings
Works with
The agents you already run
15 shipped agent and framework guides, one boundary. Same binary, same scanner pipeline, whichever agent is on the other side.
Coding agents and frameworks
Runs where your agents run
Observe and respond
Verify receipts in
Get Started
Two minutes to protection
Works with Claude Code, Cursor, VS Code, JetBrains, local stdio MCP servers, or any agent that speaks HTTP or WebSocket.
CNCF Landscape
Pipelock is listed under Provisioning · Security & Compliance.
Narrative
Detect. Enforce. Prove.
One binary, three jobs. Each line below is a real surface in the Pipelock source tree.
Detect
Fixed-order scanner pipeline. 65 DLP patterns. A2A scanning. Encoded payload handling across HTTP, WebSocket, and MCP.
Enforce
OR-composed kill switch. Adaptive escalation. Process sandbox on Linux and macOS. MCP tool policy with redirect. Fail-closed on mediated paths.
Prove
Evidence for mediated machine operations. Hash-chained flight recorder. Ed25519-signed assessment reports. 30+ attack simulations.
Capabilities
What Pipelock stops and records
The product page carries the full control inventory and deployment details.
Stop secret leaks
65 credential patterns with checksum validation. Base64, hex, URL, and Unicode encoding-aware.
Reject hostile responses
34 detection patterns. 6-pass normalization covering zero-width chars, homoglyphs, and leetspeak.
Inspect MCP tools
Stdio subprocess wrapping, tool poisoning detection, rug-pull tracking, policy engine with redirect, session binding, and chain detection.
Constrain the process
Landlock + seccomp + network namespaces on Linux. sandbox-exec on macOS. Per-agent profiles with strict mode.
Escalate on risk
Per-session threat scoring. Three escalation levels. Auto-recovery after clean traffic. No permanent lockouts.
Keep verifiable evidence
OWASP MCP Top 10, OWASP Agentic Top 10, MITRE ATLAS, EU AI Act, NIST AI RMF, HIPAA, SOC 2 mappings. Ed25519-signed reports.
Plus more surfaces
Evidence
Monitor. Block. Prove.
Three real artifacts the binary produces today. Click any panel to see how it works in production.
01 Monitor
Operator console
A read-only console over signed evidence: enforcement decisions, evidence integrity, exemptions, budgets, and fleet posture. Plus 85 Prometheus metrics.
See the console →
02 Block
6-source kill switch
Trigger from CLI, dashboard, API, signal, sentinel file, or fleet control. One source flips the agent into deny-all in under a second.
Kill-switch flow →
03 Prove
Ed25519-signed reports
7 compliance frameworks. Demo reports verify offline against the Pipelock demo key; customer reports verify against the deployment's pinned key.
View Assess →In production
Run by people who ship agents
Operators running Pipelock in front of real coding agents with real secrets.
“If I hadn't had Pipelock installed, I would've handed the keys to the kingdom to my compromised agent. It gave me enough time to figure out something was wrong, as it kept trying to get around it.”
“Even innocent debugging work is protected from my keys showing up where they shouldn't, like an agent reading a git-ignored .env during a troubleshooting run.”
verify it yourself: pipelab.org/playground/
Public methodology · Public attack cases · Public Pipelock results