Stroq is an Apache-2.0 local action firewall for AI coding agents and MCP clients. It scans output from files, web tools, shell commands and MCP calls, normalizing zero-width characters, homoglyphs and encoded content before matching 599 active rules. A suspicious result taints the session and records actionable provenance, so a later command copied from that content can be denied or presented for approval. Its policy engine classifies shell, file, network, secret, Git and configuration actions, with first-match rules, a hash-chained redacted audit log and a fail-closed response for high-impact errors. The project provides native integrations for Claude Code, Cursor, Codex, Copilot CLI and Windsurf, an in-process OpenClaw plugin, and a stdio proxy for other MCP clients. The default demonstrations replay 13 recorded incidents: nine are blocked, four require approval and none pass through under the default policy. It also indexes selected local credentials as salted hashes to detect literal secret values in outbound arguments, and protects its own policy and hook configuration from agent tampering. Coverage is not uniform: Cursor editor writes are audited rather than blocked, several hosts cannot prompt and convert “ask” to denial, and some agents do not expose their web reads or command output to hooks. The repository documents further limits, including shell-quoting evasions, large-result handling and untested Windows support. Installation starts with `npx @stroq/cli init`, while policy, audit and attack-replay commands are provided through the `stroq` CLI.
