To know what your code agent did on your machine, and why, you need a log that connects each command with what the agent had just read. Stroq is an open source CLI that keeps that log: it watches every file, web page, and tool result your agent reads, and when it detects a prompt injection, it blocks the next risky call and tells you exactly where the order came from.
yoDEV Tested · November 6, 2026
We tested Stroq 0.30.0 with Node 22 on Linux, running its Claude Code hook directly on a test project. The results we report as ours come from that test.
It’s prompt injection containment, not just logging. Most protections ask themselves one question: is this command dangerous? Stroq asks itself a second one: did something the agent just read order it to execute this? It installs with a single command, runs locally, and has an Apache-2.0 license. We installed it and attacked it ourselves; the results are below.
What is a prompt injection and why does it affect your code agent?
A prompt injection is a hidden instruction in content the model reads—a web page, an issue, a README, an MCP server response—that the model ends up obeying as if it came from you. In a chat, the damage is limited to a bad response. In a code agent that can execute commands, read your .env, and do git push, that same instruction can become a credential leak or a curl | sh against someone else’s server.
The classic pattern has two steps: the agent reads something poisoned and, right after, executes what that content asked it to. Stroq is designed to cut right between those two steps.
What is Stroq and how does it work?
Stroq is a local security layer that hooks into your agent’s tool calls. At the time of publishing this note, the npm package @stroq/cli is at version 0.30.0, published November 5, 2026, and requires Node 22 or higher. It works with Claude Code, Cursor, Codex CLI, Copilot CLI, Windsurf, and Google Antigravity through their native hooks, with OpenClaw as a plugin, and with any MCP client through a stdio proxy.
It acts at two moments:
- After the agent reads something (
PostToolUse): it normalizes the output—removes zero-width characters and homoglyphs, decodes nested base64, hex, and URL—and compares it against its rule set. In our installation,doctorreported 622 rules loaded, most taken from the Agent Threat Rules project, with an MIT license. - Before the agent acts (
PreToolUse): it classifies the action (network, destructive shell, encoded execution, secret access, external push, manipulation of its own config) and applies an ordered policy where the first matching rule wins.
Each decision goes into an audit log chained by hash at ~/.stroq/audit.jsonl, with secret values redacted.
How do you install Stroq on Claude Code?
From the root of your project:
npx @stroq/cli init
npx @stroq/cli doctor
In our test, init wrote the hooks into the project’s .claude/settings.json (PreToolUse, PostToolUse, and PostToolUseFailure). Since npm cleans its npx cache, Stroq copies itself to ~/.stroq/cli/<version>/ and points the hooks there. Want to see the change before applying it? Add --dry-run. Want it in all your projects? Add --user. To remove it: stroq uninstall.
If you use Claude Code, you can also install it as a plugin with /plugin marketplace add AGGIB/Stroq and then /plugin install stroq@stroq. The README warns that plugin installation doesn’t touch .claude/settings.json, so doctor will report those hooks as missing.
Does it work with Cursor, Codex, Copilot, or MCP servers?
Yes. For other agents, use --agent:
npx @stroq/cli init --agent cursor
npx @stroq/cli init --agent codex
npx @stroq/cli init --agent copilot
npx @stroq/cli init --agent windsurf
npx @stroq/cli init --agent antigravity
npx @stroq/cli init --agent mcp --client claude-desktop
The last option wraps your stdio MCP servers with a proxy that evaluates each tools/call and scans what it returns. If MCP security is your main front, this analysis complements well: MCP Gateway: the next major security category for agents.
How does Stroq decide what to block?
The key is where the content came from, and it was the most useful thing we learned testing it.
Content outside your project (a web page, an MCP result) contaminates the session. We passed the hook an “installation guide” downloaded from the web that asked AI assistants to read the .env and send it to an external URL. From that moment on:
| Action after the poisoned page | Stroq’s decision |
|---|---|
curl to a harmless host |
Blocked (deny-network-when-tainted) |
Read .env |
Blocked (deny-secrets-when-tainted) |
curl with the AWS key from .env |
Blocked (deny-secret-egress), value redacted in log |
git push to an attacker’s repo URL |
Blocked (deny-origin-suspect) |
ls -la |
Allowed |
git push origin main (your configured remote) |
Allowed |
Content from your own project only gets flagged. We hid an HTML comment in a README that asked agents to run curl … | sh and upload ~/.ssh/id_rsa. Stroq warned the agent to treat that text as untrusted, but didn’t restrict the session: its own message says it’s a project file. Still, it blocked the exact curl | sh that was injected and cited the README and seconds elapsed as evidence. Normal curls kept working.
That split makes sense: your own files are noisy, and contaminating the session for every suspicious comment in node_modules would make the tool unusable. External content is where injection really comes from.
How do you know what your code agent did and why?
Stroq brings several audit commands to answer exactly that question:
stroq log: recent decisions, one per line.stroq why: explains the last blocked or consulted action: what got blocked, with which rule, and which file or URL the instruction came from.stroq replay <session>: reconstructs the chain. In our test it drew the poisoned WebFetch, an arrow to thecurlcarrying the secret, “DENIED … 1 s later” and the summary “1 of 6 judged actions traced back to content the agent read”. With--htmlit exports as a single page.stroq replay --last: reads the agent’s own transcript, so it works with sessions from before installing Stroq.--allreplays all sessions from the last 30 days against the current policy.stroq sent: reports which local credentials already reached a model provider in past sessions.stroq verify: checks that the audit chain wasn’t altered.
If Stroq got it wrong, stroq untaint --session=<id> cleans the contamination; run it yourself, outside the agent. We did and the blocked curl passed on the next call.
Does Stroq stop real prompt injection attacks?
It brings its own test: stroq attack replays scenarios against your policy. In version 0.30.0 we got 36 scenarios: 26 based on public incidents (the Nx supply chain attack known as s1ngularity, RoguePilot, GitPwned, Clinejection, and several Claude Code issue reports about rm -rf and force-pushes) and 10 synthetic. Result: 15 blocked, 21 sent for approval, none passed.
Keep in mind these are scenarios from the project itself against its own policy: they show the rules do what they promise, not that they cover every possible attack. The overhead we measured was about 150 milliseconds per hook call, in line with the 100–250 ms the README indicates.
Is Stroq a sandbox?
No, and the project itself says so. The README clarifies that hooks are not a security barrier: Claude Code hooks can be disabled or bypassed, and so can Stroq’s. On Hacker News, its author described it as “a filter, not a sandbox”. The only mode the operating system enforces is the optional stroq run --sandbox, which wraps the agent in Anthropic’s srt (sandbox-exec on macOS, bubblewrap on Linux).
Other limits worth knowing:
- Protection depends on your agent. Claude Code has full allow/deny/ask (verified by the project at version 2.1.271). Codex lets everything through if the hook doesn’t start and has no “ask”; Copilot CLI lets everything through if the hook times out; Windsurf hooks don’t see command output or web downloads; Cursor doesn’t scan its own web reads.
- Secret detection is exact. Split, concatenated, or encoded secrets escape, and shell quote tricks like
c"u"rldon’t analyze fully. - Contamination is coarse. Once the session is contaminated, even an innocent network call gets blocked until you run
untaint. - It’s a young project. The npm package was created in September 2026 and publishes a new version every few days. The repo and npm only show aliases (
AGGIB,agybay_07), with no maintainer identified by name.
Is it worth installing Stroq?
If you let your code agent read web pages, issues, or MCP results and execute shell commands in the same session, Stroq gives you two things you probably don’t have now: a block on the classic “read a page and then exfiltrate” chain, and a reproducible log of what the agent did and why. Combine it with real isolation—a container, a separate user, --sandbox—rather than relying on it alone.
And you? Has your code agent ever tried to execute something you didn’t ask it to? Tell us what it was.
- I approve each command by hand
- I run it in a container or a VM
- I use hooks or permission rules
- I prefer another option (tell us which)
Comment below or, if this article reached you by email, reply directly to the email: your reply will be published here.