⬢github TypeScript · 188 ★ +166 since we first saw it · pushed 20 h ago · Apache-2.0
AGGIB/Stroq
Find known secrets in your AI coding agent sessions (Claude Code, Codex, Cursor), then guard the next one with local hooks that trace risky commands to the content that dictated them. Open source, no telemetry.
Stroq is a local security tool for AI coding agents like Claude Code, Codex, and Cursor. It audits past sessions to reveal which commands were influenced by text the agent read and whether secrets left your machine, then installs local hooks that deny or flag risky actions—like curl|sh or outbound calls carrying keys—before they run. Runs via npx, prints key names only, and sends no data anywhere.
Why now: It was recently shared on Hacker News as a 'Show HN' demo, sparking interest in auditing and guarding AI coding agents amid growing prompt-injection concerns.
Who it is for: Developers who use AI coding agents and want visibility into what those agents did and protection against prompt injection and secret leaks.
agent-securityai-agentsai-securityclaude-codecodexcoding-agentscursordeveloper-toolsfirewallhooks
Stars over our 66 snapshots: 22 to 188, since 1 d ago.
Where people talked about it
API: https://socialmediatrends-api.osmike.com/v1/repos/AGGIB/Stroq