Open-source local security layer for AI coding agents that audits past Claude Code, Codex and Cursor sessions for injected commands and leaked keys, and installs pre-tool-call hooks that block or question risky actions next time.
Follow Stroq to get an email when its listing changes, such as new pricing or features. One digest a day at most, and you can unsubscribe anytime.
- 01
`stroq` card summarizing 30 days of agent sessions: commands that came from text the agent read and keys that left the machine
- 02
`stroq sent` traces where each known credential went, printing key names, never values
- 03
`stroq replay` checks past sessions against the policy without installing hooks
- 04
Native hooks for Claude Code, Cursor, Codex, Copilot CLI, Windsurf and Antigravity, plus an OpenClaw plugin and stdio MCP proxy
- 05
Denies curl-pipe-to-shell and secret-carrying outbound calls; asks when a command repeats text the agent read
- 06
Local console on 127.0.0.1 with Check, Live, Agents, Rules and Skills & MCP screens
- 07
`stroq attack` replays 36 known attacks against your policy in a sandbox
Open Source
Free and open-source (Apache-2.0). Runs locally via `npx @stroq/cli` with no account and no telemetry.
Best for
Developers running Claude Code, Codex or Cursor locally who want to see whether prompt-injected content drove their agent's commands and to guard future sessions without a cloud service.
Not ideal for
Teams needing a true sandbox or centrally managed enterprise policy; matching is text-level and only sees what each agent's hooks expose.
A thoughtful, privacy-first audit and guard for agent sessions with clear documented limits; young and single-maintainer, but shipping weekly.
v0.30.0 (Nov 5, 2026) added the `stroq` session card, detection of tasks slipped into data the agent reads, and a five-screen console; it was posted to Hacker News as a Show HN the same day.
As of
Is Stroq free?+
Yes - Stroq is Open Source. Free and open-source (Apache-2.0). Runs locally via `npx @stroq/cli` with no account and no telemetry.
Is Stroq open source?+
Yes - Stroq is open source. Free and open-source (Apache-2.0). Runs locally via `npx @stroq/cli` with no account and no telemetry.
Who is Stroq best for?+
Developers running Claude Code, Codex or Cursor locally who want to see whether prompt-injected content drove their agent's commands and to guard future sessions without a cloud service.
Who is Stroq not ideal for?+
Teams needing a true sandbox or centrally managed enterprise policy; matching is text-level and only sees what each agent's hooks expose.
What are the best Stroq alternatives?+
The closest Stroq alternatives on ai.dosa.dev are CodeRabbit, Qodo, Snyk Code - all listed under AI Code Review & Security.
Who makes Stroq?+
Stroq is developed by Agybay Gibatollayev. It is listed in the AI Code Review & Security category on ai.dosa.dev.
Favorite this tool to revisit it later, or Zap it to contribute to the public vote count.