As AI coding agents like Claude Code, Cursor, and Codex CLI become more integrated into development workflows, they gain the ability to read local files, execute terminal commands, and interact with network resources. This autonomy introduces a significant security risk: an agent might inadvertently read a sensitive credential (such as an AWS key or a Stripe secret) and then include that secret in an outbound network call or a command execution. Stroq addresses this by providing a local security layer that monitors what these agents do and why they do it.
Stroq offers a retrospective audit of an agent's activity, allowing developers to see what happened in sessions from the previous 30 days. Using commands like `stroq sent`, the tool compares local session records against the credentials stored on the machine. It identifies whether a secret was merely seen by the AI model, used with its own service, or—most critically—sent to another company. For example, if an agent executed a `curl` command containing a secret key, Stroq identifies the specific command and the file from which the agent originally read that information. This analysis is performed locally; the tool does not require an account and sends no telemetry, ensuring that the audit itself does not create a new security surface.
This image illustrates the retrospective audit capabilities of Stroq, showing how it summarizes agent activity and identifies specific moments of concern.
To prevent future incidents, Stroq implements real-time protection through local hooks that intercept tool calls before they are executed. These hooks can automatically deny high-risk actions, such as `curl | sh` patterns, or outbound calls that carry known secrets. Beyond simple blocking, Stroq can flag actions where the agent repeats text it previously read, prompting the user for confirmation while explicitly naming the source text that dictated the command. Users can manage these policies through a local console hosted on `127.0.0.1`, which provides a dashboard for reviewing live decisions, agent-specific settings, and the rules governing various Model Context Protocol (MCP) servers.
This visual demonstrates the local console where users can review live decisions and the specific rules governing agent behavior.
While Stroq provides a robust layer of oversight, it is designed as a filter rather than a full sandbox. Its effectiveness is bounded by the specific integration limits of the agent being used; a hook can only see what the host agent chooses to send to it. Furthermore, because Stroq's tracing mechanism relies on matching text-level content, it may not be able to trace a command that a model generates entirely from scratch without any direct reference to the source text it read. Consequently, while it provides a significant increase in visibility, it does not eliminate all risks associated with autonomous agent execution.
This screenshot provides a concrete example of the tool's ability to trace a command back to the specific text that dictated it.
Stroq is open-source and operates entirely on the local machine, using a small cache under `~/.stroq` to store its records. It requires Node.js 22 or newer and is licensed under Apache-2.0. By combining retrospective 'forensics' with proactive 'guardrails,' it allows developers to maintain a higher level of trust in the agents they use for automated coding tasks.