pipelock is an open-source Go firewall that mediates and inspects outbound traffic from AI agents, blocking secret exfiltration, SSRF, and prompt injection in authorized environments.
| Tool | pipelab-org/pipelock — open-source AI agent firewall for verifiable egress control, written in Go |
| Category | AI agent security / egress proxy / DLP firewall |
| Primary Use | Interposing a policy boundary between AI agents (Claude Code, Codex, Cline, Cursor, etc.) and the network, scanning mediated HTTP, WebSocket, MCP, and A2A traffic for secret exfiltration, SSRF, and tool poisoning |
| Safe Use | Defensive deployment on systems and agents you own or are explicitly authorized to manage — agent containment in labs, CI, and enterprise environments; it is a protection tool, not an attack tool |
| Telemetry Note | Leaves signed action receipts per decision and a flight-recorder session on disk; defenders and auditors can verify receipts offline with pipelock verify-receipt against a locally held public key, and anchor checkpoints to a Rekor transparency log |
pipelock positions itself as an open-source AI agent firewall implementing what its authors call Verifiable Egress Control, and the framing is worth pausing on. The core observation in the README is blunt: an agent runtime typically holds $PROVIDER_API_KEY in its environment and has shell access, so a single outbound curl to a host like evil[.]com can exfiltrate that credential. pipelock answers this by sitting between the agent and the network as a proxy, MCP wrapper, or sandbox component, inspecting everything that crosses the boundary and emitting cryptographically signed evidence of each decision. At roughly 930 stars and 930-plus community traction under Apache-2.0 for the core, it is one of the more serious entries in the emerging agent-security category.
The traffic surface it mediates is broad for a single binary: mediated HTTP, WebSocket, MCP, and A2A traffic, plus the contents of CONNECT tunnels when TLS interception is enabled. Where TLS interception is off, plain CONNECT traffic is still scanned at the hostname and URL level — a reasonable degradation that preserves some coverage without breaking certificate pinning elsewhere. The detection goals enumerated in the README are secret exfiltration, prompt injection, SSRF, tool poisoning, and risky tool-call chains, which maps well onto the real failure modes of tool-calling agents rather than a generic web application firewall feature list.
One policy nuance reveals genuine design thought: configured MCP upstreams are exempted from private-address SSRF blocking, because local and private MCP servers are a legitimate deployment pattern. Cloud metadata endpoints remain blocked even in that exemption, closing the classic 169.254.169.254 identity-credential path that makes agent-side SSRF so much more dangerous than ordinary web SSRF. This is the kind of distinction that separates agent-aware tooling from a repackaged egress filter, and it is the detail an operator should test first when evaluating the scanner against their own topology.
The most distinctive architectural claim is the action receipt system. Every content-aware boundary decision produces a mediator-signed receipt following a published spec, so a reviewer can verify what pipelock decided outside the agent runtime — no account, no server, no vendor dashboard required. The README is refreshingly candid about the limits of this proof: the operator holds the signing key, so a receipt proves what the boundary decided and that the key holder signed it, not that the operator is honest. pipelock anchor receipts records receipt-chain checkpoints to a local backend or a Rekor transparency log for later audit, with operator-independent verification against that anchor still an explicit work in progress. The project even documents this philosophy in a piece titled demonstration over attestation.
That honesty extends to the evidence tooling. The free evidence viewer renders a scorecard grading each claim — Authentic, Untampered, Anchored, Completeness — and explicitly states what each grade does not prove, namely whether anything happened outside the boundary pipelock mediates. Below it, a receipt timeline lists recorded mediated decisions with verdicts and hash links. The workflow is straightforward: pipelock init --output ./pipelock.yaml generates a config and signing key, pipelock run --config ./pipelock.yaml records while the agent works, and pipelock evidence view --receipt-dir ./recorder --out report.html produces a static offline report. This is the kind of verifiable-logging pattern defensive teams should demand from any security product claiming to police an agent.
Evaluation is treated with unusual rigor for the genre. The public agent-egress-bench corpus exercises the detections, and the Gauntlet workflow — visible as a CI badge in the README — runs a scheduled candidate exam against a pinned corpus commit. Notably, it does not auto-publish a public score, which avoids the common failure mode of benchmark-gaming leaderboards while still giving maintainers continuous regression signal. The project also carries an OpenSSF Scorecard badge, OpenSSF Best Practices listing, codecov coverage, and a CNCF Landscape entry under Security & Compliance, plus a self-scanned badge indicating the tool scans its own workflows.
Integration breadth is a major practical selling point. The README lists compatibility with Claude Code, OpenAI Codex, Cline, OpenCode, Pi, Zed, Cursor, VS Code, JetBrains, the OpenAI Agents SDK, Google ADK, AutoGen, CrewAI, and LangGraph — essentially the current landscape of agent harnesses and frameworks. pipelock init discovers local agent integrations automatically and writes the corresponding configuration, which lowers the adoption barrier considerably compared to hand-wiring proxy environment variables per tool.
Installation is conventional for a Go project targeting the published v3.7.0 release: git clone --branch v3.7.0 --depth 1 https://github.com/pipelab-org/pipelock.git followed by make -C pipelock install builds the Community edition with Go 1.26+. Alternatives include prebuilt release binaries, docker pull ghcr.io/luckypipewrench/pipelock:3.7.0, and brew install luckyPipewrench/tap/pipelock on macOS. There is a licensing split worth flagging: source builds produce a Community-only binary, while prebuilt release artifacts include paid-tier code activated by a license key, with the enterprise directory under ELv2. Release integrity is well handled — SLSA provenance, CycloneDX SBOMs, checksums, signed container images, and from 3.6.0 an attested Helm chart verifiable via gh attestation verify against the release workflow signer.
The quick-start verification flow is a good demo of the scanner's sensitivity. pipelock check --config ./pipelock.yaml against a URL containing a concatenated AWS-style access key (AKIA plus IOSFODNN7EXAMPLE, the canonical documentation example) is blocked as an AWS Access ID in the query string, while a plain fetch of docs.python.org is allowed. This shows the detector works at the content level — recognizing credential patterns inside URLs rather than merely applying domain allowlists — and the concatenation trick in the README's own example cleverly avoids the documentation itself tripping secret scanners.
For defenders and authorized security teams, pipelock is best understood as a control, not a detection feed. Its telemetry is the receipt log: signed JSON files per action id, a flight-recorder session, and optionally anchored checkpoints in a transparency log, all inspectable offline. The enterprise tier adds a read-only operator dashboard (pipelock dashboard serve) with token, OIDC, or mTLS authentication, bounded RBAC, redacted metadata views, exemption lifecycle records, and fleet views — but the free evidence viewer covers the single-session audit case without any license. The main architectural caveat to communicate to leadership is the honesty note in the README itself: the boundary only proves what it mediated, and operator-held keys mean the guarantee is about boundary decisions, not operator integrity. Deployed alongside sandboxing and least-privilege agent environments, pipelock closes a genuine and currently under-defended gap: the point where an LLM's tool calls meet the open internet.
pipelab-org/pipelock.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.