Pipelock, from developer Luckypipewrench (Joshua Waldrep), is an open-source AI agent firewall and MCP security control for the mcp platform. Built primarily with Go, it operates as an egress proxy, sitting inline between AI agents and the network. Pipelock inspects various traffic types, including HTTP, WebSocket, Model Context Protocol (MCP), and Google Agent-to-Agent (A2A), to protect against common AI agent threats. It also scans CONNECT tunnel contents when TLS interception is active.

What does Pipelock connect to?

Pipelock connects to AI agents and the network, functioning as an egress proxy and security control. It positions itself inline between AI agents and the network to inspect mediated HTTP, WebSocket, Model Context Protocol (MCP), and Google Agent-to-Agent (A2A) traffic. When TLS interception is enabled, it also scans CONNECT tunnel contents. Its primary function is as an AI agent firewall and MCP security control. Confirmed compatible AI clients include Claude Code, Cursor, CrewAI, LangGraph, AutoGen, VS Code, and JetBrains IDEs.

Core features and tools

Pipelock exposes numerous callable tools for various operations. These include pipelock anchor receipts, pipelock audit, pipelock assess, pipelock check, and pipelock contain install. For deployment and management, tools like pipelock generate docker-compose, pipelock init, and pipelock mcp integrity manifest generate are available. It also provides tools such as pipelock posture verify, pipelock report, pipelock run, pipelock sandbox, pipelock session, and pipelock simulate to aid in security and operational tasks.

Who is it for?

Pipelock is for security teams, operators, and developers working with AI agents who need protection against credential leaks, prompt injection, SSRF, and tool poisoning. Its capabilities support securing AI agent interactions and auditing their actions. It is suitable for environments using Claude Code, Cursor, CrewAI, LangGraph, AutoGen, VS Code, Cline, and JetBrains IDEs. Faraday-based OpenAI calls also honor its proxy variables. Skip this if your security needs extend beyond proxy-level control or require native SSO integration.

How to get started

Pipelock's authentication model centers on mediator-signed action receipts, with the operator holding the Ed25519 signing key. For MCP listeners, an authentication token file can be required using "--mcp-auth-token-file".

Use cases

• Real-time Egress Control and Threat Detection: Acts as an inline proxy, scanning agent traffic for secret exfiltration, prompt injection, SSRF, tool poisoning, and risky tool-call chains, blocking unsafe traffic and emitting signed action receipts.
• CI/CD Integration for Security Audits: Integrates into CI/CD pipelines to scan pull request diffs for leaked credentials and injection patterns, using "pipelock audit" to analyze project directories and suggest configurations.
• Process Sandboxing and Containment: Provides OS-level containment for agent processes using native primitives like Landlock, seccomp, and network namespaces on Linux, or sandbox-exec on macOS, to enforce network isolation.

Pipelock provides essential security controls for AI agent interactions, offering protection against critical threats like credential leaks and prompt injection. Its proxy-level operation and support for various protocols make it a valuable tool for securing modern AI development and deployment. The focus on verifiable audit evidence through signed action receipts enhances accountability.