Open-source agent firewall that inspects MCP and agent traffic and signs every action as evidence

Pipelock is distributed as a single Go binary under Apache 2.0 and is aimed at operators already running coding agents such as Claude Code, Cursor, and IDE assistants against real repositories and real secrets. It intercepts the traffic those agents generate, applying credential detection patterns and prompt-injection detectors to responses as well as requests, enforcing which MCP tools an agent may call, and sandboxing agent processes on Linux and macOS. A kill switch can be triggered from the CLI, the dashboard, the API, a signal, or a sentinel file, cutting agent access in under a second. PipeLab lists Pipelock in the CNCF Landscape under security and compliance.

The second half of the project is evidence. Every evaluated action is written as an Ed25519-signed receipt, and the chain can be verified in a browser or offline by someone who does not trust the vendor, with sessions mapped to control frameworks and replayed publicly. Around that, PipeLab publishes Agent Egress Bench, a tool-neutral attack corpus with reproducible scoring used to compare agent firewalls including its own, and a draft Agent Evidence Level standard for grading how strong an audit trail actually is. The project began in 2024 as a homelab effort to automate a plumbing business with agents, and became a product when containing those agents turned out to be the hard part.