# Stroq — AI Coding Tool Review & Pricing

> Open-source local security layer for AI coding agents that audits past Claude Code, Codex and Cursor sessions for injected commands and leaked keys, and installs pre-tool-call hooks that block or question risky actions next time.

Source: https://ai.dosa.dev/tools/stroq · Updated Nov 6, 2026 · Category: AI Code Review & Security · Published by dosa.dev

## At a glance

- **Tool**: Stroq
- **Company**: Agybay Gibatollayev
- **Category**: [AI Code Review & Security](https://ai.dosa.dev/category/code-review)
- **Pricing model**: Open Source
- **Official website**: https://stroq.dev

## Key features

- `stroq` card summarizing 30 days of agent sessions: commands that came from text the agent read and keys that left the machine
- `stroq sent` traces where each known credential went, printing key names, never values
- `stroq replay` checks past sessions against the policy without installing hooks
- Native hooks for Claude Code, Cursor, Codex, Copilot CLI, Windsurf and Antigravity, plus an OpenClaw plugin and stdio MCP proxy
- Denies curl-pipe-to-shell and secret-carrying outbound calls; asks when a command repeats text the agent read
- Local console on 127.0.0.1 with Check, Live, Agents, Rules and Skills & MCP screens
- `stroq attack` replays 36 known attacks against your policy in a sandbox

## Pricing

**Model**: Open Source

Free and open-source (Apache-2.0). Runs locally via `npx @stroq/cli` with no account and no telemetry.

## Who it is for

- **Best for**: Developers running Claude Code, Codex or Cursor locally who want to see whether prompt-injected content drove their agent's commands and to guard future sessions without a cloud service.
- **Not ideal for**: Teams needing a true sandbox or centrally managed enterprise policy; matching is text-level and only sees what each agent's hooks expose.

## Verdict

A thoughtful, privacy-first audit and guard for agent sessions with clear documented limits; young and single-maintainer, but shipping weekly.

## Recent updates

v0.30.0 (Nov 5, 2026) added the `stroq` session card, detection of tasks slipped into data the agent reads, and a five-screen console; it was posted to Hacker News as a Show HN the same day.

## Frequently asked questions

### Is Stroq free?

Yes - Stroq is Open Source. Free and open-source (Apache-2.0). Runs locally via `npx @stroq/cli` with no account and no telemetry.

### Is Stroq open source?

Yes - Stroq is open source. Free and open-source (Apache-2.0). Runs locally via `npx @stroq/cli` with no account and no telemetry.

### Who is Stroq best for?

Developers running Claude Code, Codex or Cursor locally who want to see whether prompt-injected content drove their agent's commands and to guard future sessions without a cloud service.

### Who is Stroq not ideal for?

Teams needing a true sandbox or centrally managed enterprise policy; matching is text-level and only sees what each agent's hooks expose.

### What are the best Stroq alternatives?

The closest Stroq alternatives on ai.dosa.dev are CodeRabbit, Qodo, Snyk Code - all listed under AI Code Review & Security.

### Who makes Stroq?

Stroq is developed by Agybay Gibatollayev. It is listed in the AI Code Review & Security category on ai.dosa.dev.

## Top alternatives

- [CodeRabbit](https://ai.dosa.dev/tools/coderabbit) (Freemium) — Engineering teams and organizations that utilize AI coding agents and require a central governance layer to validate, prioritize, and secure high-velocity code output.
- [Qodo](https://ai.dosa.dev/tools/qodo-qodo) (Paid) — Enterprise engineering teams needing to enforce consistent coding standards and governance across multiple repositories, Git providers, and large-scale agentic workflows.
- [Snyk Code](https://ai.dosa.dev/tools/snyk-code-snyk) (Freemium) — Developers and DevOps teams looking for fast, integrated security scanning that reduces remediation time by automatically suggesting fixes for source code vulnerabilities.
- [cubic](https://ai.dosa.dev/tools/cubic) (Freemium) — Development teams managing complex, multi-file codebases who need repository-wide context and automated, remediation-focused security and bug detection.
- [Kodus](https://ai.dosa.dev/tools/kodus) (Freemium) — Mid-sized to enterprise teams that require highly customizable, context-aware code reviews and automated policy enforcement with strict data privacy requirements.
- [Gito](https://ai.dosa.dev/tools/gito) (Open Source) — Engineering teams prioritizing data privacy and vendor neutrality, open-source maintainers, and developers seeking automated, consistent quality checks.
- Full alternatives guide: https://ai.dosa.dev/tools/stroq/alternatives