v3.3.0 · fail-closed defaults + signed self-update CNCF Landscape · Security & Compliance

Open-source agent firewall for MCP and AI agent egress

Pipelock mediates MCP, HTTP, and WebSocket traffic at the agent boundary and emits signed action receipts any third party can verify offline when receipt signing is configured.

Wraps stdio MCP servers too, the local subprocess servers most agents actually use, with the same scanner pipeline as network upstreams. New to the category? Start with what an agent firewall does and where its boundary stops.

install

$ go install github.com/luckyPipewrench/pipelock/cmd/pipelock@latest

# Then protect Claude Code

$ pipelock claude setup

# Wrap a stdio MCP server

$ pipelock mcp proxy -- ./mcp-server

# Verify a signed receipt offline

$ pipelock verify-receipt receipt.json

# Generate a signed assessment

$ pipelock assess init && pipelock assess run assessment-*/

Get Started Free GitHub ★ 792

v3.3.0 ships · operator dashboard · evidence viewer · stricter receipts

27 public demo receipts

792+

GitHub Stars

31,000+

Test Cases

>90%

Core Coverage

Single Binary

214

Public Bench Cases

Compliance Mappings

Product metrics verified 2026-08-08 against pipelock@38bd9056b812 · corpus snapshot verified 2026-08-05 against agent-egress-bench@fb75dbf6e381.

CNCF Landscape

Pipelock is listed under Provisioning · Security & Compliance.

Listed via cncf/landscape#4807 · category: provisioning · security-compliance

View listing

Narrative

Detect. Enforce. Prove.

One binary, three jobs. Each line below is a real surface in the Pipelock source tree.

Detect

11-layer scanner pipeline. 65 DLP patterns. A2A scanning. Encoded payload handling across HTTP, WebSocket, and MCP.

11 layers 65 DLP patterns 33 injection

Enforce

OR-composed kill switch. Adaptive escalation. Process sandbox on Linux and macOS. MCP tool policy with redirect. Fail-closed on mediated paths.

6 kill sources 3 escalation levels fail-closed

Prove

Evidence for mediated machine operations. Hash-chained flight recorder. Ed25519-signed assessment reports. 30+ attack simulations.

7 frameworks Ed25519 signed offline verify

Capabilities

What Pipelock covers

A compressed view. The full inventory lives on the product page.

Data Loss Prevention

65 credential patterns with checksum validation. Base64, hex, URL, and Unicode encoding-aware.

Prompt Injection

33 detection patterns. 6-pass normalization covering zero-width chars, homoglyphs, and leetspeak.

MCP Security

Stdio subprocess wrapping, tool poisoning detection, rug-pull tracking, policy engine with redirect, session binding, and chain detection.

Process Sandbox

Landlock + seccomp + network namespaces on Linux. sandbox-exec on macOS. Per-agent profiles with strict mode.

Adaptive Enforcement

Per-session threat scoring. Three escalation levels. Auto-recovery after clean traffic. No permanent lockouts.

Compliance Evidence

OWASP MCP Top 10, OWASP Agentic Top 10, MITRE ATLAS, EU AI Act, NIST AI RMF, HIPAA, SOC 2 mappings. Ed25519-signed reports.

Plus more surfaces

65DLP 33Prompt injection 11Scanner layers Tool poisoning A2A scanning Process sandbox 6Kill switch Adaptive scoring Hash-chained log 7Frameworks 214Bench cases ~1msScan latency

See full capability inventory →

Evidence

Monitor. Block. Prove.

Three real artifacts the binary produces today. Click any panel to see how it works in production.

01 Monitor

Operator console

A read-only console over signed evidence: enforcement decisions, evidence integrity, exemptions, budgets, and fleet posture. Plus 85 Prometheus metrics.

See the console →