LabscoMCP early access ↗
luckyPipewrenchMCP SERVER · OFFICIAL PROJECT

Pipelock

A firewall between your AI agent and the network — it scans MCP, HTTP and WebSocket traffic for leaked secrets, prompt injection and risky tool chains, and signs a receipt for every decision.

by luckyPipewrench ↗Agent Guardrails, Content Safety & Audit✓ Official

LABSCO SUMMARY

A boundary that hands you evidence instead of a dashboard.

The receipts are the point: signed, verifiable offline with a key you hold, and explicit about their own limits — the scorecard states plainly that it does not prove anything about traffic outside the boundary it mediates.

What it is

An egress proxy and MCP security control that sits inline between an agent and everything it reaches. It inspects traffic in both directions, blocks or flags based on the mode you set, and writes signed evidence of what it decided.

What you get

  • MCP wrapping in three shapes: wrap a local stdio server with pipelock mcp proxy -- <command>, bridge a stdio client to a remote Streamable HTTP server with --upstream, or run the HTTP proxy and an MCP listener together
  • MCP-specific checks: tool arguments scanned for leaks and injection, server responses scanned before the agent sees them, tools/list descriptions checked for hidden instructions and mid-session rug-pull changes, 17 built-in tool-policy rules covering destructive deletes, credential access, reverse shells and persistence, and 10 category-axis patterns for detecting reconnaissance-to-exfiltration tool-call chains
  • Data-loss prevention with 65 built-in patterns for API keys, tokens, credentials, cryptocurrency keys and financial identifiers, with checksum validation — and DLP runs before DNS resolution, so a secret is caught before a lookup leaves the proxy
  • Response scanning with 33 prompt-injection and control-poisoning patterns plus six normalization passes for zero-width characters, homoglyphs, leetspeak, base64 and hex, with block, strip, warn or ask as the action
  • Streaming coverage: text/event-stream responses are scanned per event and across events, and a detection terminates the stream fail-closed
  • Optional redaction that rewrites matched secrets into typed placeholders, so receipts record the profile and per-class counts rather than plaintext
  • Containment using OS-native primitives — Landlock, seccomp and network namespaces on Linux, sandbox-exec profiles on macOS
  • Evidence you can check yourself: a hash-chained flight recorder with Ed25519-signed checkpoints, action receipts verified offline with pipelock verify-receipt, and pipelock evidence view producing a static offline report with no server
  • pipelock explain <url> naming the scanner, layer, matching rule, inspected surface and the narrowest config knob when something is a false positive

Requirements

Go 1.25+ for the source install: go install github.com/luckyPipewrench/pipelock/cmd/pipelock@latest, or take a release binary, a Docker image, or the Homebrew formula on macOS. Run pipelock init to set up local agent integrations and generate a config with a recorder directory and signing key, then pipelock check --url to confirm the scanner behaves. Plain CONNECT tunnels are scanned at the hostname and URL level only; full content inspection requires TLS interception. The demo signs with an ephemeral key it prints for the run, which proves the receipts are self-consistent rather than tied to a named identity, and the operator running Pipelock holds the signing key — so a receipt proves what the boundary decided and who signed it, not that the operator is honest. The core is Apache 2.0 with enterprise components under ELv2.

Setup effort

One command — go install github.com/luckyPipewrench/pipelock/cmd/pipelock@latest

See installation options