What is Stroq?
Stroq is a local security tool for people using AI coding agents, including Claude Code, Cursor and Codex CLI. It checks recorded sessions for known credentials and connects later agent actions to text the agent previously read. With hooks installed, Stroq can deny some risky actions or ask for approval before they run, while a local console explains its decisions. It requires Node.js 22 or newer, needs no account and sends no telemetry.
Stroq Features:
Session Secret Scan: Stroq checks recorded agent sessions against credential files on your machine and reports key names and where they appeared, never the values.
Pre-Action Hooks: Hooks for supported agents assess tool calls before they run, denying some actions and asking for approval on others.
Action Provenance: When an action repeats text from earlier tool output, Stroq can identify the source content and show its connection to the action.
Secret Egress Guard: Known secrets are indexed as salted hashes, allowing supported outbound calls containing them to be denied without displaying the secret.
Local Console: A private console on your machine shows recorded decisions, their reasons, agent hook status, and skills or MCP servers by agent.
Policy Attack Replay: A sandbox command runs 36 attack scenarios against your current policy, so you can see which are denied, questioned or allowed.
Stroq Benefits:
Faster Incident Review: When investigating a suspicious agent action, you can follow its evidence and decision instead of piecing together events from separate records.
Safer Credential Triage: Knowing which keys appeared in a session and where they went helps you decide which credentials need attention.
Fewer Blind Approvals: A warning that identifies the earlier content behind an action gives you more context for deciding whether to let it proceed.
Private Local Review: Keeping checks and console activity on your machine makes it possible to review agent security without sending session details to a remote service.
Policy Confidence: Trying attack scenarios against your policy can reveal gaps before you rely on it during everyday agent work.
Use Cases:
Credential Exposure Check: After using an agent on a project, review its sessions to see whether known keys appeared in tool output or outbound commands.
Untrusted Repository Work: Before letting an agent act on an unfamiliar repository, install hooks to examine actions that repeat instructions or commands from files it read.
Issue Triage: When an agent reads a user-submitted issue, use provenance checks to spot later actions tied to packages, commands or URLs in that content.
Agent Policy Testing: Before enabling a policy for routine coding work, replay the included attack scenarios to see how it responds to risky inputs.
Session Retrospective: If Stroq was not installed during a coding session, scan recorded sessions afterward to inspect credential matches and actions connected to earlier text.