Stroq

What is Stroq?

Stroq is a local security platform designed for AI coding agents such as Claude Code, Cursor, and Codex. It reads your recent development sessions to identify exposed secrets and traces which commands were influenced by the text the agent processed.

The tool operates entirely on your machine with no account required and no telemetry sent. It uses local hooks to evaluate every tool call before execution, blocking dangerous patterns like shell pipes or outbound requests containing known credentials. When a command repeats text the agent previously read, Stroq prompts you for confirmation.

Users can review past sessions through a private console interface or replay them against current policies without installing active hooks. The project is released under the Apache-2.0 license and requires Node.js version 22 or newer.

Stroq features

• Scans recent AI coding agent sessions for exposed secrets
• Blocks risky commands using local pre-execution hooks
• Traces commands back to the specific text that triggered them
• Provides a private local console for reviewing agent decisions
• Replays past sessions against current security policies
• Operates offline with zero telemetry and no account required

Who uses Stroq and for what

• Reviewing past Claude Code or Cursor sessions to check if API keys were accidentally passed to external services
• Blocking automated curl or wget commands that attempt to exfiltrate credentials during AI-assisted development
• Auditing AI-generated scripts before execution by tracing which agent-read files prompted the command
• Setting up local hooks to require manual approval whenever an agent repeats sensitive configuration text
• Running a sandboxed attack simulation to verify how the tool handles known prompt injection attempts

Stroq FAQ

Comments (0)

Comments and upvotes open when this product launches on ProductPerch.