The short version
Pipelock is an open-source agent firewall. It inspects HTTP, WebSocket, and MCP traffic routed through it at runtime for credential leaks, prompt injection, SSRF, and tool poisoning, and can emit signed action receipts for mediated decisions when a signing key is configured.
Snyk Agent Scan is an Apache-2.0 scanner from Snyk. Its README describes discovering the agent components installed on a machine, including harnesses, MCP servers, and skills, and scanning them for prompt injections, sensitive data handling, and malware patterns. It installs with uvx or a release binary, runs with a Snyk API token, and warns that scanning an MCP configuration executes the commands defined in it, because that is how it reads the tool descriptions. The Invariant Labs mcp-scan repository redirects here.
Agent Scan checks what is installed before you trust it. Pipelock checks what it does while it runs. Snyk’s announcement also names Agent Guard, a runtime policy enforcer in private preview; this page compares the open-source scanner only, because the guard is in private preview and its behavior is not documented publicly.
Feature comparison
| Feature | Pipelock | Snyk Agent Scan |
|---|---|---|
| When it runs | Continuously, on live traffic | Point in time, on demand or in CI |
| What it examines | HTTP, WebSocket, and MCP payloads as they flow | Installed harnesses, MCP servers, and skills |
| Tool-description poisoning | Scanned at runtime, fingerprinted, drift flagged | Scanned at scan time |
| Rug-pull drift after install | Detected when a description changes mid-session | Not a runtime function; re-scan to see it |
| Credential scanning (DLP) | 65 patterns, encoding-aware, on live traffic | Sensitive data handling checks on components |
| Prompt injection | Deterministic patterns with multi-pass normalization on responses | Injection checks on component content |
| Malware patterns in skills | Not in scope | Yes |
| SSRF protection | Yes | Not in scope |
| Enforcement | Blocks or warns on mediated traffic | Reports; not on the traffic path |
| Signed receipts | Yes, Ed25519, verifiable offline | Reports |
| License | Apache-2.0 core; Enterprise under ELv2 | Apache-2.0 |
Where Snyk Agent Scan is stronger
Discovery. It finds what is installed, across harnesses, servers, and skills, which a network proxy never enumerates.
Skill and malware checks. Agent skills are scanned for malware patterns and unsafe handling before they are used. Pipelock doesn’t analyze installed components.
Fits CI. A scan is a report you can gate a pipeline on.
Where Pipelock is stronger
Runtime truth. A component that passed a scan can still change later. Pipelock reads the tool description every session, fingerprints it, and flags drift.
Traffic inspection. Credentials in a request body, an injected web page, an SSRF attempt: none of these are in a component scan. Pipelock inspects the traffic itself.
Enforcement and evidence. Pipelock blocks on mediated paths and can emit signed receipts for mediated decisions when a signing key is configured. A scanner reports.
Scan, then inspect
The two tools stop failures at different moments. A poisoned skill in a marketplace is caught at install time by a scanner. A tool description that changes after the agent connected, or a response that carries an injection, is caught on the wire by a firewall. Teams that care about both run both.
Further reading
- Agent firewall vs agent sandbox: where install-time and runtime controls sit
- Pipelock vs DefenseClaw: another tool that scans components before they run
- MCP tool poisoning: what the scanners and the firewall both look for
- Pipelock on GitHub
Sources checked
Third-party descriptions on this page come from the public materials below, read on the dates shown. Features and pricing change; check the current documentation before you decide.
Third-party product names and marks belong to their owners. PipeLab is not affiliated with, sponsored by, or endorsed by the makers of any product compared on this page. Descriptions of other products come from their own public materials on the dates listed above and reflect PipeLab's reading of them. If something here is wrong or out of date, tell us and it will be corrected.