Stroq
Find the secrets in your agent's past sessions. Stop risky commands in the next.
4 website clicks
Launch week 46, 2026
About Stroq
Stroq is an open‑source Agent Guard that runs on Node 22+ and inspects the origin of a command before allowing it to execute. It normalizes tool output, tracks provenance of packages or URLs, and blocks outbound calls that contain indexed secrets, reporting the variable and file name. By integrating with Claude Code, Codex CLI, Cursor, and similar agents, Stroq applies deterministic, model‑free policies and logs every decision, helping developers prevent secret leaks and unintended actions without sending data to external services.
Stroq is an open‑source Agent Guard that runs on Node 22+ and inspects where a command originated before allowing it to execute. It normalizes tool output, tracks provenance of packages or URLs, and blocks outbound calls that contain indexed secrets, reporting the variable and file name. By hooking into Claude Code, Codex CLI, Cursor and similar agents, Stroq applies deterministic, model‑free policies and logs every decision, helping developers prevent secret leaks and unintended actions without sending data to external services.
Overview
Who is it for?
Developers
Features
- Normalization: strips zero‑width characters, folds homoglyphs, and decodes base64, hex and URLs two levels deep.
- Provenance: records the earlier tool output that introduced a package, URL or command fragment and reports it when later used.
- Secret Egress Guard: indexes secrets as salted hashes and denies any outbound call that includes a known secret, naming the variable and source file.
Use cases
- Security and Compliance
- Block commands that would expose known secrets, preventing credential leakage.
- Identify the file or prior command that introduced a suspicious package before execution.
- Detect hidden malicious payloads through deep normalization of tool output.
- You can use Stroq to prevent secret leaks, block suspicious commands, and understand the origin of actions taken by agents in your development workflow.
Details
- Pricing
- Free
- Built for
- Developers
- Platforms
- Node 22 or newer
- Categories
- Developer Tools Open-Source Cybersecurity
- Launched
- Last updated
More details
Integrations
Claude Code
Codex CLI
Cursor
Copilot CLI
Pros
Deterministic decisions with no machine‑learning model.
No network traffic in the hot path, preserving privacy.
Audit log records every decision in a hash‑chained JSONL file.
Policy is editable via a simple YAML file.
Works with multiple coding agents via standard hooks.
Free‑forever license and runs locally without telemetry.
What is Stroq?
Stroq is an Agent Guard that monitors coding assistants, normalizes their output, tracks provenance, and enforces policies to block unsafe actions.
What are its key features?
It provides deep normalization of text, provenance tracking of earlier tool outputs, and a secret egress guard that denies outbound calls containing indexed secrets.
How does it compare to alternatives?
Unlike many guards that rely on machine‑learning models, Stroq uses deterministic regex scans and policy rules, runs locally without telemetry, and provides explicit provenance information.
What integrations and ecosystem support does it offer?
Stroq integrates with Claude Code, Codex CLI, Cursor, and Copilot CLI, and can be installed via npm to hook into any standard MCP client.
What are its pros?
It offers model‑free enforcement, local operation, an editable audit log, customizable policies, and a free‑forever Apache‑2.0 license.
Alternatives
Resources
FAQ about Stroq
What license does Stroq use?
Stroq is released under the Apache‑2.0 license.
How do you install Stroq?
Install it with npm using npx @stroq/cli, then run npx @stroq/cli init to set up hooks for supported agents.
Similar products
Launched
Ownership
If this is your product, contact us and we can help transfer it to you.
ChatGPT,
Claude,
Perplexity,
Gemini
