Stroq is an open-source security platform designed for AI coding agents like Claude Code, Codex, and Cursor. It analyzes user sessions to identify how many commands originated from text the agent read and which machine keys left the system. The tool operates with zero telemetry, no accounts, and writes only a small cache to the local disk.
It offers a command-line interface for viewing session cards, initiating guards, and replaying past sessions against current policies. Beyond the interactive card, Stroq functions as a local security platform that intercepts tool calls before execution. Its hooks deny risky operations like "curl | sh" and block outbound calls carrying known machine secrets.
The console provides a private interface on 127.0.0.1 where users can replay historical sessions, check if keys were transmitted, and manage security rules. Stroq emphasizes local processing, requiring Node.js 22 or newer and operating under the Apache-2.0 license. It aims to give users visibility and control over agent actions without sending data to external servers.
Source: Hacker News · Summarized by HeadlinesBriefing