Show HN: Stroq – a local audit of what your coding agent did and why

Stroq released version 0.30.0 of its local security platform for AI coding agents, distributed as the npm package @stroq/cli under Apache-2.0 and requiring Node.js 22 or newer. Stroq reads the last 30 days of Claude Code and Codex CLI sessions, key files and working folders, prints key names but never values, writes only a small cache under ~/.stroq and sends no telemetry, while its hooks deny commands such as `curl | sh` and outbound calls carrying a known secret and ask the user first when a command repeats text the agent read. The tool also offers a `replay --all` mode that checks existing sessions against the policy without installing hooks, and an `attack` command that demonstrates Stroq stopping 36 known attacks in a sandbox.

Stroq reads your own Claude Code and Codex sessions and shows how many commands came from text your agent read, and which keys left your machine. <sub An example: a made-up machine with made-up sessions, keys and hosts. Hoo is Stroq's owl. Your card shows your own sessions.</sub npx @stroq/cli It reads your last 30 days of sessions, your key files and the folders your agent worked in; prints key names, never values; writes nothing but a small cache under ~/.stroq ; and sends nothing. No account, no telemetry. npx @stroq/cli a card of your own sessions, like the one above npx @stroq/cli init stop it next time: guard your agent npx @stroq/cli why why an action was stopped npx @stroq/cli attack watch Stroq stop 36 known attacks, in a sandbox npx @stroq/cli uninstall remove Stroq Every moment on the card has a stroq show line that prints the evidence behind it npx @stroq/cli show 1 . stroq help --all lists the other commands. Needs Node.js 22 or newer. Apache-2.0. Stroq is a local security platform for AI coding agents: Claude Code, Cursor, Codex CLI and others. Its hooks judge every tool call before it runs. They deny curl | sh and outbound calls that carry a known secret from your machine, and they ask you first when a command repeats text the agent read, naming that text. The console shows which agents actually ask Stroq, and every decision with its reason. Sessions you already had can be checked too, without installing anything. npx @stroq/cli console the console: a private page on 127.0.0.1 npx @stroq/cli replay --all your Claude Code sessions of the last 30 days against the policy; no hooks needed npx @stroq/cli sent did your agent pass your keys on? key names, never values npx @stroq/cli init hook into your agent and guard the next session <sub A made-up machine: made-up sessions, keys and hosts. Nothing was executed.</sub | Check : the card of stroq , made by the same code. Each moment opens with its evidence, under it one line for each agent. | Live : recorded decisions as they happen. A row opens into its chain: what the agent read, what it did, the decision, the rule. | | Agents : add or remove Stroq's hooks, with the exact file change shown first. When Stroq was last asked, and which of an agent's settings weaken it. | Skills & MCP : every skill and MCP server by agent: where it came from, what the rules matched in it, what changed since you last looked. | The fifth screen is Rules : try an action without running it, turn rules on with a preview and a test, the history with an undo, and the rules reference. Connected means Stroq's hooks are in the agent's settings, not that the agent calls them: Test hook and Live show that. <sub Screens from a build just before 0.30.0, reading a made-up machine: made-up sessions, keys and hosts. Nothing was executed.</sub npx @stroq/cli console a private page on 127.0.0.1 npx @stroq/cli console --workspace /path/to/repo the project it should look at Open the whole link it prints: it carries a key that is new each time the console starts. The console reads what Stroq already records on this machine. It changes an agent's settings or Stroq's policy only after you confirm a preview of that change; checks you run are saved under ~/.stroq . It listens only on 127.0.0.1, needs no account and has no telemetry. Nothing in it starts your agent: Test hook runs the hook once, offline. Adding hooks from the console needs macOS or Linux; on Windows use stroq init . Details and limits: console guide https://github.com/AGGIB/Stroq/blob/main/console/README.md . From a source checkout: pnpm install --frozen-lockfile pnpm --dir console install --ignore-workspace --frozen-lockfile pnpm platform:build pnpm platform --workspace /path/to/repo <sub Output of the 0.29.0 CLI on a made-up Claude Code transcript of the same story; the path is shortened.</sub stroq replay reads the agent's own transcript, so it works on sessions from before Stroq was installed: which content the agent read, and which later actions came out of it. --all goes through every session of the last 30 days and says which to open. Nothing runs and nothing is sent; the verdicts are today's policy's, not a record of what happened at the time. stroq sent compares your Claude Code, Codex CLI and Cursor sessions with the credentials on your machine and says where each key went: sent to another company, maybe sent, seen by the AI, used with its own service, or blocked before it ran. It prints names and sources, never values. Start with the session secret scan walkthrough https://stroq.dev/session-secret-scan/ no session yet? try it with a made-up key https://stroq.dev/session-secret-scan/ try-it . What a stroq sent finding looks like Made-up keys, the built CLI's output, trimmed: stroq sent: did your AI agent pass your keys on? 6 of your 6 keys appear in your agent sessions: 2 sent to another company, 1 maybe sent, 1 seen by the AI, 1 used with its own service, 1 blocked before it ran. Checked 3 sessions Claude Code 2, Codex 1 , 2026-10-02 to 2026-10-19. Compared with 6 keys: ~/.aws/credentials, ~/.npmrc, ~/work/shop/.env, ~/work/api/.env. SENT TO ANOTHER COMPANY: rotate these today 2 1. STRIPE SECRET KEY from ~/work/shop/.env went to collector.example, in a curl command when 2026-10-11 14:02 UTC · Claude Code · ~/work/shop do revoke it at https://dashboard.stripe.com/apikeys, then update ~/work/shop/.env SEEN BY THE AI: your agent's model saw these keys 1 4. aws secret access key from ~/.aws/credentials seen in the output of a Read of ~/.aws/credentials when 2026-10-02 09:42 UTC · Claude Code · ~/work/api note Not ruled out: 2 later commands in that session could reach the network. do your agent's model saw it; rotate it if that matters: https://console.aws.amazon.com/iam/home /security credentials Stroq names a send only when it sees the key in the command that sent it. A script, a file or a variable can carry a key out without showing it. stroq attack runs 36 attacks, from public reports and synthetic cells, against your policy in a throwaway home: on 0.30.0, 15 are denied, 21 are asked about, 0 pass through. - Before each action. Native hooks for Claude Code, Cursor, Codex, Copilot CLI, Windsurf and Antigravity, a plugin for OpenClaw, and a stdio MCP proxy. Supported outbound calls containing a known secret can be denied; provenance ties later actions to the tool output they repeat. A question about a value copied from text the agent read is asked once per session in Claude Code, unless the session has started something in the background. - After the fact. replay and sent read local session records, including sessions from before Stroq was installed. Old, rotated or unknown values may be missed, and a key that did not show in a command may still have left in a script, a file or a variable. A local transcript match does not by itself prove delivery to a model provider. - Local. No outbound network calls from the hooks; the hook of an older Task Lock run speaks only to its local parent controller. No telemetry. - Limits. A hook sees only what the host sends it, and that differs by agent and version. Matching is text-level, so a command the model writes from scratch does not trace back to a source. It is a filter, not a sandbox. Read the integration limits https://github.com/AGGIB/Stroq/blob/main/docs/AGENTS.md before relying on a live hook. - Guide https://github.com/AGGIB/Stroq/blob/main/docs/GUIDE.md : everything, section by section. Install https://github.com/AGGIB/Stroq/blob/main/docs/GUIDE.md install · Commands https://github.com/AGGIB/Stroq/blob/main/docs/GUIDE.md commands · How it works https://github.com/AGGIB/Stroq/blob/main/docs/GUIDE.md how-it-works · Guarantees and limits https://github.com/AGGIB/Stroq/blob/main/docs/GUIDE.md guarantees-and-limits - Per-agent details https://github.com/AGGIB/Stroq/blob/main/docs/AGENTS.md : what each agent's hooks allow, and every documented limit - False positives https://github.com/AGGIB/Stroq/blob/main/docs/BENCH.md · Attack coverage https://github.com/AGGIB/Stroq/blob/main/docs/COVERAGE.md · Cloak vs AgentCloak https://github.com/AGGIB/Stroq/blob/main/docs/CLOAK-COMPARISON.md - Security https://github.com/AGGIB/Stroq/blob/main/SECURITY.md · Changelog https://github.com/AGGIB/Stroq/blob/main/CHANGELOG.md · Contributing https://github.com/AGGIB/Stroq/blob/main/CONTRIBUTING.md Thank you to everyone who contributes code, reports bugs, tests agent integrations, and improves the docs ❤️