Open-source agent firewall for MCP and AI agent egress
Pipelock enforces MCP, HTTP, and WebSocket egress at the network boundary and produces verifiable audit evidence for every inspected action.
v2.4.0 ships · learn-and-lock contracts · block reason headers · inbound envelope verification
342+
GitHub Stars
15400+
Tests
40
Releases
~20MB
Single Binary
151
Bench Cases
5
Frameworks
CNCF Landscape · April 2026
Pipelock is currently the only AI-agent-firewall listed under Provisioning · Security & Compliance.
Narrative
Detect. Enforce. Prove.
One binary, three jobs. Each line below is a real surface in the Pipelock source tree.
Detect
11-layer scanner pipeline. 48 DLP patterns. A2A scanning. Encoded payload handling across HTTP, WebSocket, and MCP.
Enforce
OR-composed kill switch. Adaptive escalation. Process sandbox on Linux and macOS. MCP tool policy with redirect. Fail-closed on every path.
Prove
Evidence for every machine operation. Hash-chained flight recorder. Ed25519-signed assessment reports. 24+ attack simulations.
Capabilities
What Pipelock covers
A compressed view. The full inventory lives on the product page.
Data Loss Prevention
48 credential patterns with checksum validation. Base64, hex, URL, and Unicode encoding-aware.
Prompt Injection
25 detection patterns. 6-pass normalization covering zero-width chars, homoglyphs, and leetspeak.
MCP Security
Tool poisoning detection, rug-pull tracking, policy engine with redirect, session binding, and chain detection.
Process Sandbox
Landlock + seccomp + network namespaces on Linux. sandbox-exec on macOS. Per-agent profiles with strict mode.
Adaptive Enforcement
Per-session threat scoring. Three escalation levels. Auto-recovery after clean traffic. No permanent lockouts.
Compliance Evidence
OWASP MCP Top 10, OWASP Agentic Top 10, MITRE ATLAS, EU AI Act, SOC 2 mappings. Ed25519-signed reports.
Plus more surfaces
Evidence
Monitor. Block. Prove.
Three real artifacts the binary produces today. Click any panel to see how it works in production.
01 Monitor
Live fleet dashboard
70 Prometheus metrics across the fleet. Threat score, kill state, scan latency, blocked verdict counts.
See dashboard →
02 Block
4-source kill switch
Trigger from CLI, dashboard, API, or Telegram. One source flips the agent into deny-all in under a second.
Kill-switch flow →
03 Prove
Ed25519-signed reports
5 compliance frameworks. Reports verify offline against the published public key.
View Assess →Get Started
Two minutes to protection
Works with Claude Code, Cursor, VS Code, JetBrains, or any agent that speaks HTTP.
Public methodology · Public attack cases · Public Pipelock results