luckyPipewrench/pipelock

Open-source AI agent firewall for MCP security and agent egress. Scans mediated HTTP, MCP, A2A, and WebSocket traffic for exfiltration, SSRF, and prompt injection, and emits mediator-signed action receipts: verifiable audit evidence from outside the agent.

What it solves

Pipelock is an AI agent firewall that prevents AI agents from leaking sensitive secrets (like API keys) to the internet, protects against prompt injection, and blocks SSRF and tool poisoning attacks. It creates a verifiable boundary between an agent's environment and the network, ensuring that every action is inspected and recorded.

How it works

It acts as an inline proxy (supporting HTTP, WebSocket, MCP, and A2A traffic) that scans outbound and inbound traffic. It uses a multi-layered scanner pipeline including DLP (Data Loss Prevention) with 65+ built-in patterns, entropy analysis to detect encoded secrets, and response scanning for prompt injection. To ensure transparency, Pipelock emits signed "action receipts" that allow reviewers to verify security decisions offline without needing to trust a central dashboard.

Who it’s for

Developers and organizations deploying AI agents (using frameworks like AutoGen, CrewAI, LangGraph, or tools like Claude Code and Cursor) who need to enforce strict egress control and security auditing in regulated or high-security environments.

Highlights

  • Verifiable Egress Control: Generates signed receipts for every decision, allowing for independent, offline verification of security events.
  • Multi-Mode Enforcement: Offers strict (allowlist-only), balanced (detects sophisticated attacks), and audit (logging only) modes.
  • Comprehensive Scanning: Detects secret exfiltration, DNS tunneling, chunked exfiltration, and prompt injection across various protocols including SSE streaming.
  • Tool Integration: Works with a wide range of AI agents and IDEs, and includes a specialized hostile-model preset for uncensored models.
  • Explainable Security: Provides a CLI tool to explain exactly why a specific URL or event was blocked, identifying the specific rule and config knob involved.