The short version
Pipelock is an open-source agent firewall. It runs as a single Go binary on the agent’s routed network path and scans HTTP, WebSocket, and MCP traffic for credential leaks, prompt injection, SSRF, and tool poisoning. With a signing key configured, it can emit signed action receipts for mediated decisions. The verifier checks them offline.
Backslash Security sells what its site calls an agentic AI endpoint security platform. It rates MCP servers, skills, and plugins on security posture and supply-chain risk, lets security teams allowlist, blocklist, or require approval before installation, and surfaces unmanaged agent use on developer machines. The public pieces are the MCP Server Security Hub and a Skills Security Scanner. The enterprise platform covers a long list of AI coding agents and clients.
Pipelock is a binary you run in your own environment and inspect at runtime. Backslash is a platform you buy to govern what gets installed.
Feature comparison
| Feature | Pipelock | Backslash Security |
|---|---|---|
| Architecture | Self-hosted single binary on the network path | Vendor platform with endpoint and client integrations |
| Primary job | Runtime inspection of mediated HTTP, WebSocket, and MCP traffic | Pre-install vetting and governance of servers, skills, and plugins |
| Credential scanning (DLP) | 65 built-in patterns, encoding-aware, on mediated traffic | Not described in the public materials read; the site describes an audit trail of MCP communications and agent network access |
| Prompt injection detection | Deterministic patterns with multi-pass normalization on scanned responses and tool descriptions | Not described in public materials |
| Tool poisoning | Mediated description scanning and rug-pull drift detection | Rates servers and skills before installation |
| SSRF protection | Mediated private-IP, metadata, and DNS rebinding checks | Not described in public materials |
| Client coverage | Any client whose traffic is routed through the proxy | Named list of AI coding agents and desktop clients |
| Public catalog | No | MCP Server Security Hub and Skills Security Scanner, free |
| Signed receipts | Available with a signing key; Ed25519, verifiable offline | Not described in public materials |
| Source availability | Apache-2.0 core; Enterprise under ELv2 | Closed source |
| Pricing | Free core; paid Pro and Enterprise tiers | Contact sales |
When to pick Pipelock
You need payload inspection on the wire. Backslash describes an audit trail of MCP communications and agent network access at the endpoint. A server that passed a rating can still return an injected response or change its tool description later, and catching that needs the bytes inspected on the path. Pipelock reads traffic routed through it as it happens.
You want to self-host and audit the rules. Every DLP regex, injection pattern, and normalization pass is in the public repository. You can fork it, audit it, or run it air-gapped.
You want evidence. With a signing key and allow-path receipt enforcement configured, Pipelock refuses to forward an allowed mediated request whose signed receipt cannot be emitted. The verifier checks signed receipts offline against your key.
When to pick Backslash
Your problem is governance across many developer endpoints. If the question is “which MCP servers, skills, and plugins are our developers installing, and which should be allowed”, Backslash is built around that question and integrates with the clients developers already use.
You want a public rating catalog. The MCP Server Security Hub and Skills Security Scanner give teams a free place to check a server or skill before installing it. Pipelock has no catalog.
Procurement needs a vendor. Commercial support, SLAs, and a named company behind the product matter to some buyers. Pipelock’s free core is a different answer to a different question.
Different moments in the lifecycle
Backslash acts at the endpoint: rate it, allow it, block it, send it for approval, and keep an audit trail of what the harness did. Pipelock acts on the routed network path: read what the installed thing sends and receives, block configured unsafe findings, and emit signed receipts when a signing key is configured. A team that wants both install-time governance and runtime inspection can run both because the controls operate at different points.
Further reading
- What is an agent firewall?: definition and evaluation checklist
- Agent firewall vs guardrails: where enforcement happens
- Pipelock vs Runlayer: another governance-platform comparison
- MCP security: the full scope of MCP threats
- Pipelock on GitHub
Sources checked
Third-party descriptions on this page come from the public materials below, read on the dates shown. Features and pricing change; check the current documentation before you decide.
Third-party product names and marks belong to their owners. PipeLab is not affiliated with, sponsored by, or endorsed by the makers of any product compared on this page. Descriptions of other products come from their own public materials on the dates listed above and reflect PipeLab's reading of them. If something here is wrong or out of date, tell us and it will be corrected.