The receipts are the point: signed, verifiable offline with a key you hold, and explicit about their own limits — the scorecard states plainly that it does not prove anything about traffic outside the boundary it mediates.
An egress proxy and MCP security control that sits inline between an agent and everything it reaches. It inspects traffic in both directions, blocks or flags based on the mode you set, and writes signed evidence of what it decided.
- MCP wrapping in three shapes: wrap a local stdio server with `pipelock mcp proxy -- <command>`, bridge a stdio client to a remote Streamable HTTP server with `--upstream`, or run the HTTP proxy and an MCP listener together
- MCP-specific checks: tool arguments scanned for leaks and injection, server responses scanned before the agent sees them, `tools/list` descriptions checked for hidden instructions and mid-session rug-pull changes, 17 built-in tool-policy rules covering destructive deletes, credential access, reverse shells and persistence, and 10 category-axis patterns for detecting reconnaissance-to-exfiltration tool-call chains
- Data-loss prevention with 65 built-in patterns for API keys, tokens, credentials, cryptocurrency keys and financial identifiers, with checksum validation — and DLP runs before DNS resolution, so a secret is caught before a lookup leaves the proxy
- Response scanning with 33 prompt-injection and control-poisoning patterns plus six normalization passes for zero-width characters, homoglyphs, leetspeak, base64 and hex, with `block`, `strip`, `warn` or `ask` as the action
- Streaming coverage: `text/event-stream` responses are scanned per event and across events, and a detection terminates the stream fail-closed
- Optional redaction that rewrites matched secrets into typed placeholders, so receipts record the profile and per-class counts rather than plaintext
- Containment using OS-native primitives — Landlock, seccomp and network namespaces on Linux, `sandbox-exec` profiles on macOS
- Evidence you can check yourself: a hash-chained flight recorder with Ed25519-signed checkpoints, action receipts verified offline with `pipelock verify-receipt`, and `pipelock evidence view` producing a static offline report with no server
- `pipelock explain <url>` naming the scanner, layer, matching rule, inspected surface and the narrowest config knob when something is a false positive
Go 1.25+ for the source install: `go install github.com/luckyPipewrench/pipelock/cmd/pipelock@latest`, or take a release binary, a Docker image, or the Homebrew formula on macOS. Run `pipelock init` to set up local agent integrations and generate a config with a recorder directory and signing key, then `pipelock check --url` to confirm the scanner behaves. Plain CONNECT tunnels are scanned at the hostname and URL level only; full content inspection requires TLS interception. The demo signs with an ephemeral key it prints for the run, which proves the receipts are self-consistent rather than tied to a named identity, and the operator running Pipelock holds the signing key — so a receipt proves what the boundary decided and who signed it, not that the operator is honest. The core is Apache 2.0 with enterprise components under ELv2.
One command — go install github.com/luckyPipewrench/pipelock/cmd/pipelock@latest