{"schema_version":1,"name":"Stroq","slug":"stroq","url":"https://softwareontheweb.com/product/stroq","website":"https://stroq.dev","tagline":"Find the secrets in your agent's past sessions. Stop risky commands in the next.","description_markdown":"Stroq is an open‑source Agent Guard that runs on Node 22+ and inspects the origin of a command before allowing it to execute. It normalizes tool output, tracks provenance of packages or URLs, and blocks outbound calls that contain indexed secrets, reporting the variable and file name. By integrating with Claude Code, Codex CLI, Cursor, and similar agents, Stroq applies deterministic, model‑free policies and logs every decision, helping developers prevent secret leaks and unintended actions without sending data to external services.\n\n## Key Features\n\n- Normalization: strips zero‑width characters, folds homoglyphs, and decodes base64, hex and URLs two levels deep.\n- Provenance: records the earlier tool output that introduced a package, URL or command fragment and reports it when later used.\n- Secret Egress Guard: indexes secrets as salted hashes and denies any outbound call that includes a known secret, naming the variable and source file.\n\n## Best For\n\n- Developers\n\n## Top Use Cases\n\n- Block commands that would expose known secrets, preventing credential leakage.\n- Identify the file or prior command that introduced a suspicious package before execution.\n- Detect hidden malicious payloads through deep normalization of tool output.\n\n## Integrations\n\n- Claude Code\n- Codex CLI\n- Cursor\n- Copilot CLI\n\n## Pros\n\n- Deterministic decisions with no machine‑learning model.\n- No network traffic in the hot path, preserving privacy.\n- Audit log records every decision in a hash‑chained JSONL file.\n- Policy is editable via a simple YAML file.\n- Works with multiple coding agents via standard hooks.\n- Free‑forever license and runs locally without telemetry.\n\n### What is Stroq?\n\nStroq is an Agent Guard that monitors coding assistants, normalizes their output, tracks provenance, and enforces policies to block unsafe actions.\n\n### What are its key features?\n\nIt provides deep normalization of text, provenance tracking of earlier tool outputs, and a secret egress guard that denies outbound calls containing indexed secrets.\n\n### Who is it best for?\n\nIt is aimed at developers who use AI coding agents and need to protect their environments from accidental secret exposure or malicious commands.\n\n### What can you use it for?\n\nYou can use Stroq to prevent secret leaks, block suspicious commands, and understand the origin of actions taken by agents in your development workflow.\n\n### How does it compare to alternatives?\n\nUnlike many guards that rely on machine‑learning models, Stroq uses deterministic regex scans and policy rules, runs locally without telemetry, and provides explicit provenance information.\n\n### What integrations and ecosystem support does it offer?\n\nStroq integrates with Claude Code, Codex CLI, Cursor, and Copilot CLI, and can be installed via npm to hook into any standard MCP client.\n\n### What are its pros?\n\nIt offers model‑free enforcement, local operation, an editable audit log, customizable policies, and a free‑forever Apache‑2.0 license.","categories":["Developer Tools","Free","Open-Source","Cybersecurity","Developers","Security and Compliance"],"published_at":"2026-11-09T04:00:00+00:00","updated_at":"2026-11-09T04:00:12+00:00"}