pipelab-org/pipelock

Pipelock – Open‑source AI‑agent firewall

What it is – Pipelock is a Go‑based, single‑binary proxy that sits between an LLM‑powered AI agent and the internet. It inspects every HTTP, WebSocket, MCP (Message‑Control‑Protocol) and agent‑to‑agent request, optionally decrypting TLS tunnels, and decides whether to allow, block, or flag the traffic. For every decision it writes a mediator‑signed receipt that can be verified offline, giving operators cryptographic proof of what the firewall did.

Why it matters – AI agents often run with powerful credentials (API keys, cloud tokens, SSH keys) and have shell access. A single curl or a crafted prompt can exfiltrate those secrets. Pipelock creates a verifiable “boundary” that all outbound traffic must cross, turning a trust‑based dashboard into a tamper‑evident audit trail.

---

Core features (as described in the README)

Feature	What it does
Traffic inspection	Mediates HTTP, WebSocket, MCP and A2A traffic; can decrypt CONNECT tunnels when TLS interception is enabled.
Threat detection	Blocks secret exfiltration, prompt‑injection, SSRF, tool‑poisoning, risky tool‑call chains, DNS tunneling, chunked exfiltration, high‑entropy blobs, etc.
Three operating modes	strict (allow‑list only), balanced (default – blocks naïve attacks, detects sophisticated ones), audit (logs everything, only core floors block).
Signed action receipts	Every allow/deny decision is signed with a key held by the operator; receipts can be verified locally or against a transparency log (Rekor).
Evidence viewer & dashboard	Free offline HTML viewer (pipelock evidence view) and an enterprise‑only read‑only dashboard with RBAC, OIDC/mTLS auth, redaction, and fleet‑wide metrics.
Integration ecosystem	Works with Claude Code, OpenAI Codex, Cline, OpenCode, Pi, Zed, Cursor, VS Code, JetBrains, OpenAI Agents SDK, Google ADK, AutoGen, CrewAI, LangGraph, etc.
Reporting & monitoring	pipelock report produces HTML/JSON/signed bundles; Prometheus & Grafana exporters are provided for live metrics.
Policy presets	Includes a hostile-model preset that adds aggressive entropy thresholds, tool‑blocking, session binding, and a kill‑switch for untrusted model toolchains.
Open‑source compliance	Uses Apache 2.0 (core) and an Enterprise ELv2 license for paid features; CI, SLSA provenance, SBOMs, and attestation verification are built‑in.

---

How it works (high‑level architecture)

1. Proxy entry point – Agents are configured to use Pipelock as an HTTP/HTTPS proxy (or via the MCP wrapper). All outbound requests flow through it.
2. Scanning pipeline – Requests pass a deterministic series of checks: URL parsing → scheme validation → CRLF/path‑traversal → allow‑/block‑list → literal‑IP SSRF → DLP patterns → entropy analysis → nested‑URL detection → DNS‑SSR​F protection → rate‑limit/budget → final policy verdict.
3. Decision & receipt – The proxy either allows the request, blocks it, or records a warning. It then emits a JSON receipt signed with the operator’s private key, containing the request hash, verdict, policy version, and optional audit metadata.
4. Evidence storage – Receipts are written to a recorder directory (flight‑recorder). Operators can later run pipelock evidence view to generate a static HTML report or serve it read‑only.
5. Anchoring (optional) – Receipts can be anchored to a local backend or a public transparency log (Rekor) for immutable, third‑party verification.

---

Getting started (quick‑start steps from the README)

# 1. Clone the tagged release and build the community binary
git clone --branch v3.7.0 --depth 1 https://github.com/luckyPipewrench/pipelock.git
make -C pipelock install   # produces `pipelock`

# 2. Generate a starter config that discovers local agent integrations
pipelock init --output ./pipelock.yaml

# 3. Test the scanner on a known secret URL (should be blocked)
 p ipelock check --config ./pipelock.yaml \
   --url "https://api.vendor.example/?k=$(printf '%s%s' 'AKIA' 'IOSFODNN7EXAMPLE')"

# 4. Run the proxy for a real agent
pipelock run --config ./pipelock.yaml   # then point your agent's HTTP proxy to localhost:PORT

Other install options (binary download, Docker image, Homebrew) are listed in the README, as are commands to verify the release attestation with gh attestation verify.

---

When you’d use Pipelock

• Enterprises or regulated sectors that must prove no secret leakage from AI agents (finance, healthcare, defense). Use strict mode and the signed receipt chain.
• Development teams building custom agents (AutoGen, CrewAI, LangGraph, etc.) who want a default balanced protection without rewriting their code.
• Security auditors who need reproducible, cryptographically‑verifiable evidence of what an agent attempted to send.
• Operators of multi‑tenant AI services who want per‑agent RBAC, budget limits, and fleet‑wide monitoring via Prometheus/Grafana.

---

Limitations & honest notes (as called out by the project)

• The proxy can only control traffic that is routed through it; tools that ignore proxy settings can still reach the internet unless additional OS/container sandboxing is applied.
• Signed receipts prove what the proxy decided and that the operator signed it, but they do not prove that the operator is honest or that no out‑of‑band leaks occurred.
• Enterprise‑only features (dashboard, RBAC, multi‑agent fleet view, kill‑switch) require a paid license; the community binary provides the core scanning and receipt generation.

---

Links & resources

• Live playground: https://pipelab.org/playground
• Benchmark corpus: https://github.com/luckyPipewrench/agent-egress-bench
• Documentation: https://pipelab.org/learn/open-source-ai-firewall/
• Discord community: https://discord.gg/badNfhGKTc
• Release page: https://github.com/luckyPipewrench/pipelock/releases

---

All information above is taken directly from the repository’s README; no additional features have been inferred.