Stroq is an open-source local firewall designed to secure coding agents by monitoring their actions and preventing unauthorized execution of instructions found in untrusted text. The tool operates by hooking into agent processes, scanning read content, and tracking session data to block malicious commands, such as network requests or unauthorized file access.
The project addresses vulnerabilities like Sentry agentjacking, where agents were manipulated via MCP to execute malicious code, and incidents involving secret exfiltration. Stroq uses a normalization engine to decode base64, hex, and URL-encoded strings, applying 599 active rules to evaluate agent actions. It categorizes actions into 13 classes, including shell, network, and file system operations.
To prevent data leaks, Stroq indexes local secrets like AWS credentials and .env files as salted hashes. If an agent attempts to use a value matching a known secret in an outbound action, the firewall blocks the request. The system maintains an audit log in a hash-chained JSONL format to ensure integrity, with a security mode set to 0600.
Stroq includes a testing suite that models 13 known security incidents to validate its policy. The tool features a build-time performance gate that disables rules exceeding a 25 ms execution threshold. Currently, the tool introduces a latency of 100–250 ms per hook call due to the Node.js process startup, with plans for a local daemon to improve performance.
