Stroq

<div align="center"> <picture> <source media="(prefers-color-scheme: dark)" srcset="docs/assets/logo-dark.svg"> <img src="docs/assets/logo.svg" alt="Stroq" width="340"> </picture> ### Find known secrets in AI coding agent sessions [](https://github.com/AGGIB/Stroq/actions/workflows/ci.yml) [](docs/GUIDE.md#replay-thirty-five-real-and-synthetic-attacks) [](https://www.npmjs.com/package/@stroq/cli) [](https://www.npmjs.com/package/@stroq/cli) [](LICENSE) </div> Stroq scans recorded Claude Code, Codex CLI and Cursor sessions for values matching credentials on your machine. It names the credential and the tool call without printing the value, then helps guard supported actions in future sessions. A local transcript match does not by itself prove delivery to a model provider. ```bash npx @stroq/cli sent --last # scan the latest recorded session; no hook setup needed npx @stroq/cli init # hook into your agent and guard the next session ``` What a finding looks like (a synthetic session, trimmed): ```text stroq sent — credential evidence in recorded agent sessions ✗ 1 known credential value(s) in this session's recorded tool calls: aws_secret_access_key CREDENTIAL VALUES FOUND IN THIS SESSION RECORD (1) ● aws_secret_access_key — ~/.aws/credentials seen once, first at 2026-09-28T10:00:01Z └─ in the result of Read ~/.aws/credentials NEXT Rotate each credential named above that is still live. aws_secret_access_key: https://console.aws.amazon.com/iam/home#/security_credentials ``` <img src="docs/assets/case-study.gif" alt="An agent fixing a bug runs a helper package named in a GitHub issue, reads .env, and POSTs an AWS secret key to an unknown collector. stroq replay --last traces both commands back to that issue, and with Stroq installed the request is denied by deny-secret-egress, naming the variable, the file and the issue it came from." width="820"> <img src="docs/assets/demo.gif" alt="stroq replay --last on a recorded session: a poisoned README scores SUSPECT and the curl | sh it dictated is denied 12 seconds later; an npx command copied from an MCP result is asked about and traced back to it; an unrelated pnpm test is allowed" width="800"> - **Looks back.** `stroq sent` reads local Claude Code, Codex CLI and Cursor records, including sessions from before Stroq was installed. It matches known values in available tool arguments and results, and reports names and sources, not values. It reads local credential files to build the comparison index; old, rotated or unknown values may be missed. - **Guards what's next.** Native hooks for Claude Code, Cursor, Codex, Copilot CLI, Windsurf and Antigravity, a plugin for OpenClaw, and a stdio MCP proxy. Supported outbound calls containing a known secret can be denied; provenance ties some later actions to earlier tool output. Coverage depends on the host, version and channel. - **Local.** No network calls from the hooks, no telemetry. Apache-2.0. Start with the [session secret scan walkthrough](https://stroq.dev/session-secret-scan/) or read [integration limits](docs/AGENTS.md) before relying on a live hook. ## Docs - **[Guide](docs/GUIDE.md)**: everything, section by section. [Install](docs/GUIDE.md#install) · [Commands](docs/GUIDE.md#commands) · [How it works](docs/GUIDE.md#how-it-works) · [Guarantees and limits](docs/GUIDE.md#guarantees-and-limits) - [Per-agent details](docs/AGENTS.md): what each agent's hooks allow, and every documented limit - [False positives](docs/BENCH.md) · [Attack coverage](docs/COVERAGE.md) · [Cloak vs AgentCloak](docs/CLOAK-COMPARISON.md) - [Security](SECURITY.md) · [Changelog](CHANGELOG.md) · [Contributing](CONTRIBUTING.md) [stroq.dev](https://stroq.dev)