Pipelock

About Pipelock

Pipelock, from PipeLab, is an open-source firewall that sits at the boundary of an AI agent and mediates what it is allowed to send out. It proxies MCP, HTTP and WebSocket traffic and can wrap a stdio MCP server directly, which means it covers both the tools an agent calls and the network it reaches while calling them. The scanner pipeline runs eleven layers: sixty-five DLP patterns for keys, tokens and PII, MCP input, response and tool-poisoning checks, prompt-injection detection across encoding chains, and SSRF, private-IP and cloud-metadata blocking. Enforcement is fail-closed by design, with a kill switch fed by six independent sources, adaptive enforcement with human-in-the-loop approval, MCP tool policies that can warn, block, redirect or defer, and kernel-level egress containment through nftables owner-match on Linux plus a Landlock and seccomp process sandbox. What separates it from a guardrail library is the evidence half: every decision emits an Ed25519-signed receipt that any third party can verify offline using free verifiers published in Go, TypeScript, Rust and Python, and the project publishes signed audit reports in HTML, JSON and SARIF along with hot-reloadable community rule bundles. The core is Apache-2.0, ships as a single Go binary, does not phone home and is not machine-bound; the site publishes a live playground, a public benchmark scoreboard against other vendors, and an OWASP MCP Top 10 mapping showing which control covers each risk.

Key Features

Tags