The short version
Pipelock is an open-source agent firewall. It inspects HTTP, WebSocket, and MCP traffic routed through it on the agent’s network path for credential leaks, prompt injection, SSRF, and tool poisoning. With a signing key configured, it can emit signed action receipts for mediated decisions. It can run beside the agent wherever the deployment routes traffic through it.
AgentCore Gateway is part of Amazon Bedrock AgentCore. Its developer guide describes one endpoint that routes and secures agentic traffic. It converts APIs, Lambda functions, and existing services into MCP-compatible tools from OpenAPI, Smithy, or Lambda definitions, and fronts other agents and HTTP services as passthrough targets, including A2A. It also routes model requests across providers and manages OAuth authorization for who may call it and how it calls upstream. A policy feature evaluates tool calls at the gateway.
AgentCore Gateway is managed plumbing and authorization inside AWS. Pipelock is inspection and evidence next to the agent.
Feature comparison
| Feature | Pipelock | AgentCore Gateway |
|---|---|---|
| Architecture | Self-hosted single binary on the agent’s path | Managed AWS endpoint |
| What it fronts | Traffic routed through it: HTTP, HTTPS CONNECT (payloads only with TLS interception on), WebSocket, MCP, A2A | MCP tools built from APIs, Lambda, and services; other agents and HTTP services; model providers |
| Tool creation | No; it inspects tools that exist | Yes, from OpenAPI, Smithy, and Lambda |
| Authorization | Tool policy via config | OAuth ingress and egress; policy evaluation on tool calls |
| Model routing | No | Yes |
| Credential scanning (DLP) | 65 patterns, encoding-aware, on mediated traffic | Not described in the pages read |
| Prompt injection detection | Deterministic patterns with multi-pass normalization on mediated traffic | Not described in the pages read |
| Tool poisoning and rug-pull drift | Fingerprinting and drift detection on mediated MCP traffic | Not described in the pages read |
| SSRF protection | Mediated private-IP, metadata, and DNS rebinding checks | Not described in the pages read |
| Evidence | Signed receipts when configured, verifiable offline with the operator’s key | AWS logging |
| Runs outside AWS | Yes | No |
| Source and pricing | Apache-2.0 core, free | Closed; AWS usage pricing |
Where AgentCore Gateway is stronger
Tool creation from what you already have. An OpenAPI spec or a Lambda function becomes an MCP tool without writing a server.
Managed auth on both sides. OAuth for callers and for upstreams, run by AWS.
One endpoint for tools, agents, and models. Composition and model routing in the same place, with policy evaluation on the calls.
Nothing to operate. It is a service in your account.
Where Pipelock is stronger
Content inspection. Pipelock applies encoding-aware DLP to mediated bodies and arguments, injection normalization to mediated responses, tool-description fingerprinting and drift detection to mediated MCP traffic, and SSRF checks before DNS. The AgentCore pages read describe authorization and translation, not payload scanning.
Portability. Pipelock runs on a laptop, a CI runner, or any cloud, and inspects the agent’s whole path, not only calls to one gateway, when the deployment routes all egress through it (containment or a container with the proxy as its only route).
Evidence you hold. With a signing key and allow-path receipt enforcement configured, Pipelock refuses to forward an allowed mediated request whose signed receipt cannot be emitted. Its verifier checks signed receipts offline against your key.
Architecture difference
Agent -> AgentCore Gateway (OAuth in, translate, policy, OAuth out) -> APIs, Lambda, agents, models
Agent -> Pipelock (inspect, decide, sign) -> AgentCore Gateway and everything else
Put the gateway in front of the AWS estate and the firewall next to the agent.
Further reading
- Pipelock vs agentgateway: the open-source proxy with a similar shape
- Pipelock vs Cloudflare AI Gateway: another hosted gateway, at the model boundary
- Agent firewall vs agent authorization gateway: the concept behind the authorization rows
- Pipelock on GitHub
Sources checked
Third-party descriptions on this page come from the public materials below, read on the dates shown. Features and pricing change; check the current documentation before you decide.
- Amazon Bedrock AgentCore developer guide: Gateway
- Amazon Bedrock AgentCore developer guide: Gateway with Policy
Third-party product names and marks belong to their owners. PipeLab is not affiliated with, sponsored by, or endorsed by the makers of any product compared on this page. Descriptions of other products come from their own public materials on the dates listed above and reflect PipeLab's reading of them. If something here is wrong or out of date, tell us and it will be corrected.