Pipelock CLI
CLI mediator scans agent network requests and MCP calls for secret leaks, unsafe destinations and injected instructions
- 984 ★ on the repository
- Last commit
- Apache-2.0
Extended access
Why this level
- The mediator receives tool requests and responses that can contain secrets
- Some modes change network restrictions and certificate trust settings
Install
- Works in
Manual install
git clone --branch v3.7.0 --depth 1 https://github.com/pipelab-org/pipelock.git
make -C pipelock installThe README quick start’s first command installation route builds Community v3.7.0; requires Go 1.26 or later. Inspect sources first; we did not run commands.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The mediator receives tool requests and responses that can contain secrets
- Some modes change network restrictions and certificate trust settings
This is third-party code. Review the repository files before installing.
What it does
Pipelock checks agent traffic routed through its proxy. It compares destinations and request content with a selected policy, then allows, blocks or modifies detected sensitive fragments. In MCP mode, Pipelock starts a local server or connects the client to a remote one. It scans tool arguments and responses and looks for hidden instructions in descriptions. HTTP uses a separate proxy; inspecting HTTPS content requires TLS interception setup. Pipelock logs decisions and supports signed action records. A signature can verify record provenance but cannot establish that the scanner’s decision was correct. Diagnostics check settings and whether the client actually routes traffic through the proxy.
Who it is for. For developers and security engineers who need to inspect a running agent's network traffic and MCP tools.
Good fit when
- Inspect a selected MCP server's arguments and responses before forwarding
- Restrict agent requests to an approved set of destinations
- Retain signed decision records for incident investigation
- Check whether a client actually uses the configured network mediator
Not a fit when
- You expect setting a proxy to prevent every direct connection by any program
- You need flawless classification of instructions or complete leak prevention
- You cannot configure certificate trust but need arbitrary HTTPS payload inspection
Example request
Prepare Pipelock for one test MCP server. Show the configuration and coverage boundaries first, then test one safe request. Do not install system network restrictions without agreement.Limitations
pipelock exec sets proxy environment variables, but clients can ignore them; enforced network restrictions require separate OS controls. The readiness check before client startup does not monitor proxy health throughout a session. TLS inspection needs a signing CA and client trust, while excluded domains receive no content scanning. Community source builds require Go 1.26 and lack the usual signed-release updater; rebuild them separately.
How to disable. Stop the proxy and restore the client's previous connection. If OS restrictions were installed, follow that mode's rollback procedure. Removing the binary alone does not restore certificate or network settings or delete logs.
FAQ
How do I wrap a local MCP server?
Use `pipelock mcp proxy --config pipelock.yaml -- <server command>`, replacing the command with the real server launcher. Pipelock starts it and scans mediated messages.
Can I connect a remote HTTP MCP server?
Yes. `pipelock mcp proxy --upstream http://localhost:8080/mcp` bridges a stdio client to that server. Replace the example with your test deployment.
How do I launch Claude Code through a running proxy?
Start the proxy with `pipelock run --config pipelock.yaml`. In another terminal, run `pipelock exec --config pipelock.yaml -- claude`. It checks the service and passes settings to the client; then verify that the client uses that network route.
Does `audit` mode only record actions?
No. Ordinary policy findings warn, while core destination checks can still block. Review mode semantics before using it with a working agent.
Which features are free?
Core scanners, containment modes, signature verification and the single-session evidence viewer. Named-agent profiles, the operator dashboard and fleet management belong to separate editions.
Which licenses apply to the editions?
The core uses Apache-2.0. Pro and Enterprise features use ELv2 and require a license key.
Discussion
No questions or reviews yet.
Related
CLI toolsMCP server on mitmproxy: the agent reads HTTP traffic, rewrites responses, replays requests and builds an API spec.
Security scanner for MCP servers that looks for hardcoded keys, tool poisoning and injection flaws in repository code.
A gateway for MCP servers with plugins for masking known secret patterns in text responses, reputation checks and call logging
70 tools for the Caido proxy: request history, replay, fuzzing and findings for an agent during authorized security testing.
A scanner that finds leaked keys, dangerous access and connected models in MCP configs of Claude Desktop, Cursor and VS Code.
MCP checks shell commands, while shellfirm hooks apply rules to supported agent calls before they execute
README in short
Installation examples target release 3.7.0. Prebuilt releases include update-verification keys and code for additional editions activated by a license.