# Stroq

> Stroq's Agent Guard helps developers safeguard sensitive data by tracking its origin and enforcing secret egress policies. Available on Node 22 or newer, Stroq's freemium pricing model offers flexibility for various use cases.

Canonical: https://softwareontheweb.com/product/stroq
Last updated: 2026-11-09

## About

Stroq is an open‑source Agent Guard that runs on Node 22+ and inspects the origin of a command before allowing it to execute. It normalizes tool output, tracks provenance of packages or URLs, and blocks outbound calls that contain indexed secrets, reporting the variable and file name. By integrating with Claude Code, Codex CLI, Cursor, and similar agents, Stroq applies deterministic, model‑free policies and logs every decision, helping developers prevent secret leaks and unintended actions without sending data to external services.

Stroq is an open‑source Agent Guard that runs on Node 22+ and inspects where a command originated before allowing it to execute. It normalizes tool output, tracks provenance of packages or URLs, and blocks outbound calls that contain indexed secrets, reporting the variable and file name. By hooking into Claude Code, Codex CLI, Cursor and similar agents, Stroq applies deterministic, model‑free policies and logs every decision, helping developers prevent secret leaks and unintended actions without sending data to external services.

- [Stroq homepage showing Find the secrets in your agent's past sessions. Stop risky commands in the next](https://softwareontheweb.com/storage/product_media/medium_stroq-homepage-screenshot.webp)
### Who is it for?

Developers


## Features

- Normalization: strips zero‑width characters, folds homoglyphs, and decodes base64, hex and URLs two levels deep.
- Provenance: records the earlier tool output that introduced a package, URL or command fragment and reports it when later used.
- Secret Egress Guard: indexes secrets as salted hashes and denies any outbound call that includes a known secret, naming the variable and source file.

## Use cases

- Security and Compliance
- Block commands that would expose known secrets, preventing credential leakage.
- Identify the file or prior command that introduced a suspicious package before execution.
- Detect hidden malicious payloads through deep normalization of tool output.
- You can use Stroq to prevent secret leaks, block suspicious commands, and understand the origin of actions taken by agents in your development workflow.

## Details

| Field | Value |
| --- | --- |
| Pricing | Free |
| Built for | Developers |
| Platforms | Node 22 or newer |
| Categories | Developer Tools, Open-Source, Cybersecurity |

## More details

### Integrations

- Claude Code
- Codex CLI
- Cursor
- Copilot CLI

### Pros

- Deterministic decisions with no machine‑learning model.
- No network traffic in the hot path, preserving privacy.
- Audit log records every decision in a hash‑chained JSONL file.
- Policy is editable via a simple YAML file.
- Works with multiple coding agents via standard hooks.
- Free‑forever license and runs locally without telemetry.

### What is Stroq?

Stroq is an Agent Guard that monitors coding assistants, normalizes their output, tracks provenance, and enforces policies to block unsafe actions.

### What are its key features?

It provides deep normalization of text, provenance tracking of earlier tool outputs, and a secret egress guard that denies outbound calls containing indexed secrets.

### How does it compare to alternatives?

Unlike many guards that rely on machine‑learning models, Stroq uses deterministic regex scans and policy rules, runs locally without telemetry, and provides explicit provenance information.

### What integrations and ecosystem support does it offer?

Stroq integrates with Claude Code, Codex CLI, Cursor, and Copilot CLI, and can be installed via npm to hook into any standard MCP client.

### What are its pros?

It offers model‑free enforcement, local operation, an editable audit log, customizable policies, and a free‑forever Apache‑2.0 license.
- [github.com](https://github.com/AGGIB/Stroq)

### What license does Stroq use?

Stroq is released under the Apache‑2.0 license.

### How do you install Stroq?

Install it with npm using npx @stroq/cli, then run npx @stroq/cli init to set up hooks for supported agents.

## Related
- [Home](https://softwareontheweb.com/)
- [Topics](https://softwareontheweb.com/topics)
- [Official website](https://stroq.dev)
- [Offsend Extension](https://softwareontheweb.com/product/offsend-extension)
- [crypt.fyi](https://softwareontheweb.com/product/cryptfyi)
- [OmniRoute](https://softwareontheweb.com/product/omniroute)