Pipelock
FreemiumOpen-source agent firewall for MCP security and AI agent egress
By Tanmay Verma, Founder · Last verified 06 Jul 2026
0 views
Added 6d ago
77/100Safe BetIn short
Pipelock — Open-source agent firewall for MCP security and AI agent egress. Best for Teams deploying coding agents (Claude Code, Cursor, etc.) that need network egress control, Security engineers looking for open-source runtime guardrails for MCP agents, Organizations that require signed audit evidence for compliance (SOC 2, HIPAA, EU AI Act). Free to start; paid plans from $999/mo.
Is Pipelock actually worth it?
LiveSee what real users actually say. We scan live discussions, reviews and complaints across the web and hand you an honest verdict — in under a minute.
3 free scans · no card needed · downloadable report
Editorial Verdict
Best for
Teams deploying coding agents (Claude Code, Cursor, etc.) that need network egress controlSecurity engineers looking for open-source runtime guardrails for MCP agentsOrganizations that require signed audit evidence for compliance (SOC 2, HIPAA, EU AI Act)Developers wanting to prevent credential exfiltration and prompt injection in agent pipelinesFleet operators managing multiple agent profiles with centralized governance
Not ideal for
Non-technical users who need a point-and-click GUITeams that don't run AI agents or MCP servicesOrganizations needing a full web application firewall for non-agent trafficShops that prefer fully managed SaaS with zero self-hosting
Pipelock is the most mature open-source option for MCP agent firewall needs. Its flat pricing and signed receipts are unique, but it requires CLI comfort and self-hosting. For teams using Claude Code or Cursor who need to prevent credential leaks and prompt injection, the free tier is a strong starting point.
Skip Pipelock if Skip Pipelock if you need a GUI-based firewall or fully managed SaaS, or if you don't run coding agents like Claude Code or Cursor that send outbound traffic.
Last verified: July 2026
What's new in Pipelock
Checked 3 days agoAcross the latest 7 updates: 4 feature updates, 1 launch, 1 changelog entry and 1 news mention.
ChangelogBlog·4 days agoNewest
Pipelock v? (No data for today; using blog index as of 2026-07-06)
Blog index shows 47 posts; latest is v3.0 release from Jun 23.
FeatureBlog·17 days ago
Pipelock v3.0 Release
Pipelock v3.0 hardens defaults to fail closed, adds signed self-update, provider-key DLP, and Conductor fleet operations.
FeatureBlog·May 31
Pipelock v2.6 Release
Pipelock v2.6 adds operation-level request policy, file-borne injection detection, hook-based agent inspection, and MCP hardening from NSA guidance.
FeatureBlog·May 20
Pipelock v2.5.0 Release
Pipelock v2.5.0 ships Audit Packet verifiers, host containment lifecycle commands, strict federation, MCP integrity, and IDE installers.
LaunchBlog·May 10
Agent Egress Control launch
Pipelock Agent Egress Control v0.1.0: GitHub Action that wraps agent scripts in kernel-enforced network containment and writes signed Audit Packets.
FeatureBlog·May 4
Pipelock v2.4.0 Release
Pipelock v2.4.0 ships learn-and-lock contracts, block reason headers, inbound envelope verification, Gemini redaction, and health checks.
NewsBlog·Apr 12
State of MCP Security 2026
Report on MCP security: public incidents, CVE trends, OWASP MCP Top 10 mapping, and control coverage across scanners, gateways, and inspection tools.
What independent users actually report about Pipelock
We ran a structured research pass across product reviews, community discussions, and post-purchase forum threads to surface the patterns vendors won't publish themselves. Below: the recurring strengths, the hidden costs people mention most, and the cohort that consistently regrets adopting this tool.
15 mentions across 4 sources (Hacker News, Bluesky, GitHub, Lemmy).
65% positive35% critical
Recurring strengths
- +Open-source Apache 2.0 license with free core engine
- +Capability separation architecture is clean and principled
- +11-layer scanner covers HTTP, WebSocket, MCP, and A2A
- +65 DLP credential patterns with checksum validation
- +Prompt-injection detection with 29 patterns and normalization
Recurring frustrations
- −Entropy scan implementation questioned for simplicity
- −Multi-agent orchestration support is unclear
- −Limited community adoption and vendor support
- −GitHub repository has 7 open issues
- −Static analysis coverage is missing from runtime focus
Patterns worth knowing
Capability separation architecture is a key differentiator
Seen on Hacker News, Bluesky
Pipelock addresses a real visibility gap in AI agent behavior
Seen on Hacker News, Bluesky
Community concerned about implementation details (e.g., entropy scan)
Seen on Hacker News
Learning curve
intermediateProductive in ~A few hours
Hidden costs people mention
- • Paid plans required for team collaboration features; pricing not publicly available
Viability Score
77/100
Safe BetHow likely is Pipelock to still be operational in 12 months? Based on 4 signals — momentum (how recently it shipped), wrapper dependency, revenue model, and web presence.
momentum
55
funding runway
80
website health
90
wrapper dependency
100
Last calculated: July 2026
How we score →Key Features
- 11-layer scanner pipeline for HTTP, WebSocket, and MCP
- 65 DLP credential patterns with checksum validation
- Prompt-injection detection (29 patterns, 6-pass normalization)
- MCP tool poisoning detection and policy engine with redirect
- Process sandbox (Landlock + seccomp on Linux, sandbox-exec on macOS)
- Adaptive enforcement with three escalation levels
- 4-source kill switch (CLI, dashboard, API, Telegram) fail-closed
- Ed25519-signed audit reports verifiable offline
- Hash-chained flight recorder for every operation
- Compliance evidence mapping (OWASP MCP Top 10, OWASP Agentic Top 10, MITRE ATLAS, EU AI Act, NIST AI RMF, HIPAA, SOC 2)
- TLS interception and cross-request detection
- Fetch, forward, WebSocket, and MCP proxy (stdio + HTTP)
- Named security profiles with per-profile policies
- Dedicated agent listeners with spoof-proof CIDR resolution
- Signed self-update and hot-reloadable rule bundles
About Pipelock
FreemiumIntermediateNo APICLI
Pipelock is an open-source agent firewall that sits between AI agents and the internet, scanning every HTTP, WebSocket, and MCP message to block secret leaks, unsafe tool traffic, and prompt-injection responses. It enforces egress at the network boundary and emits signed action receipts any third party can verify offline. The core security engine is free and Apache 2.0 licensed; paid plans add multi-agent coordination and fleet governance. It's designed for teams running coding agents like Claude Code, Cursor, VS Code, or JetBrains that need runtime guardrails without per-agent pricing. The v3.0.0 release hardened defaults to fail closed, added signed self-update, provider-key DLP, and Conductor fleet operations. Pipelock enforces MCP, HTTP, and WebSocket egress at the network boundary and emits signed action receipts any third party can verify offline. Compared to alternatives like MCP gateways from vendors, Pipelock offers flat pricing, open-source auditability, and compliance evidence mappings across seven frameworks.
Behind the Verdict
We'd reach for Pipelock when we're running coding agents with access to sensitive credentials and need to enforce egress without per-agent pricing. The free Community tier already includes the full scanner pipeline, DLP, prompt injection detection, process sandbox, and signed reports—enough for a single agent profile. If you manage multiple named profiles, the Founding Pro tier at $49/mo flat is a bargain, especially compared to per-seat competitors. The compliance evidence mappings (OWASP, MITRE ATLAS, EU AI Act, HIPAA, SOC 2) make it a natural fit for regulated environments. Where it bites: Pipelock is not a point-and-click GUI—you'll need to be comfortable with CLI and self-hosting. It's also not a full web application firewall; it's laser-focused on AI agent traffic. If you need a fully managed SaaS solution, look elsewhere. Compared to other agent firewalls, Pipelock's open-source core and offline-verifiable receipts are unique, but the trade-off is operational complexity.
Researching Pipelock? Get your full AI stack in 60 seconds.
Free, no signup — tell us your goal and get tools matched to your budget & existing stack.
Real-world workflow fit
Concrete scenarios for the personas Pipelock actually fits — and what changes day-one when you adopt it.
Security engineer at a startup deploying Claude Code for the dev team
Wire all developer Claude Code instances through a local Pipelock proxy to block credential leaks. Configure the Community tier with the default security profile, enable the Telegram kill switch, and generate signed audit reports weekly for compliance review.
Outcome: Credential exfiltration blocked on day one, signed audit trail for SOC 2 readiness, and zero per-agent cost.
Platform team managing multiple agent profiles across different projects
Set up Pipelock Pro with named security profiles for each project (e.g., one for frontend, one for backend). Configure per-profile DLP allowlists for project-specific domains and per-profile MCP tool policies to restrict dangerous tools like `write_file`.
Outcome: Centralized policy enforcement with no per-agent pricing, cross-agent session isolation prevents leaks between projects.
Compliance officer at a fintech required to produce verifiable audit evidence for EU AI Act
Run pipelock assess to get a hash-chained, Ed25519-signed assessment report. Map findings to NIST AI RMF and EU AI Act controls. Verify the report offline using the free verifier.
Outcome: Produce compliance evidence within hours, verifiable by auditors without a vendor portal.
Use Cases
- Block credential leaks from Claude Code by scanning outgoing traffic for API keys and tokens
- Enforce MCP tool policies to prevent tool poisoning attacks in agent workflows
- Generate signed audit reports for SOC 2 compliance during agent runtime assessments
- Deploy process sandboxing to contain agent subprocesses on Linux and macOS
- Use the kill switch to instantly deny all egress when a prompt injection is detected
- Run pipelock assess to get a signed security assessment for compliance evidence
Models Under the Hood
No LLM models used; Pipelock is a proxy/firewall, not an AI model.
as of 2026-07-06
Limitations
- Pipelock is a CLI tool with no web GUI; it requires command-line proficiency to install and configure.
- The free Community tier is limited to a single default security profile; multi-agent coordination requires a paid Pro or Enterprise plan.
- While the binary is <30MB and has ~1ms scan latency, it still needs to be deployed as a proxy, which may add a hop for agent traffic.
as of 2026-07-06
12-month cost
Project the real annual outlay, including the implied monthly cost when only an annual tier is published.
Annual total
Free
Over 12 months
Effective monthly
Free
Billed monthly
Vendor list price only. Add-on usage, seat overages, and contract minimums are surfaced under Hidden costs & gotchas.
Plans compared
For each published Pipelock tier: who it actually fits, and what it adds vs. the previous tier. Cross-reference the cost calculator above for projected annual outlay.
Community
$0/mo
Ideal for
Solo developer or hobbyist running one coding agent (e.g., Claude Code) who wants free, open-source egress control and DLP without per-agent pricing.
What this tier adds
Free entry point with full scanner pipeline, signed reports, and kill switch, but limited to one default security profile.
Founding Pro
$49/mo ($490/yr)
Ideal for
Startup or small team coordinating 2+ agent profiles (e.g., separate profiles for dev and ops) who need per-profile DLP, allowlists, and MCP tool policies.
What this tier adds
Adds unlimited named security profiles, per-profile policies, dedicated agent listeners, and cross-agent session isolation. Grandfathered at $49/mo for first 50 customers.
Assess License
$999/yr
Ideal for
Compliance officer or security consultant needing a signed, offline-verifiable security assessment report with compliance mappings (OWASP, NIST, EU AI Act, SOC 2).
What this tier adds
Standalone one-year license for pipelock assess, producing hash-chained Ed25519-signed assessment with risk rating and badge.
Enterprise
$25,000/yr
Ideal for
Organization managing a fleet of agents across teams requiring central governance, signed policy distribution, and fleet audit aggregation for compliance.
What this tier adds
Adds signed fleet policy bundles, remote kill, durable fleet audit aggregation, live stream observability, and enrollment-token lifecycle management.
Integrations
Where the pricing makes sense
The company stage and team size where Pipelock's pricing actually pencils out — and where peers do it cheaper.
Pipelock's free Community tier offers a full security engine with no per-agent pricing, making it ideal for solo developers and small teams exploring agent guardrails. The $49/mo Founding Pro tier (grandfathered for first 50) is competitive with vendor-specific tools like the Claude Code Pro subscription ($20/mo per user) but covers unlimited profiles and agents. Enterprise at $25,000/year is flat-rate, which can be cheaper than per-agent competitors like Valence Security or Wiz Agent Security
Setup time & first value
How long it actually takes to get something useful out of Pipelock — broken out by persona, not the marketing-page minute.
For a single agent like Claude Code, setup takes about 2 minutes: run `brew install luckyPipewrench/tap/pipelock`, then `pipelock claude setup`. Multi-agent or fleet setups take 30-60 minutes to define named profiles and configure policies per profile. Enterprise fleet governance involves deploying the Conductor and configuring enrollment tokens, which can take a few hours for initial setup.
Switching to or from Pipelock
How to bring data in from common predecessors and how to get it back out — written for the switcher, not the buyer.
Migrating in
- →From no agent firewall: Install Pipelock via Homebrew and wire your agent's HTTPS_PROXY to localhost:8765. The scanner starts blocking immediately with no changes to your agent workflow.
- →From a custom iptables/nftables rule: Use Pipelock's nftables integration to augment kernel-level egress control with DLP and MCP scanning, without rewriting your existing rules.
Migrating out
- ↗To a managed agent security service (e.g., Valence): Export your security profiles and audit reports from Pipelock (JSON/SARIF) and import them into the managed service's policy engine. Agent configuration changes are
- ↗To a full API gateway like Kong: Reconfigure your agent's proxy to point to the gateway instead of Pipelock. Signed receipts can be archived for compliance.
Resources & Guides
- Learnpipelab.org
Learn · Pipelock
Educational content from pipelab.org
- Resourcepipelab.org
Playground · Pipelock
Helpful link from pipelab.org
- Resourcepipelab.org
Blog · Pipelock
Helpful link from pipelab.org
- Resourcepipelab.org
Compare · Pipelock
Helpful link from pipelab.org
- Resourcepipelab.org
Proof · Pipelock
Helpful link from pipelab.org
- Resourcepipelab.org
Enterprise · Pipelock
Helpful link from pipelab.org
Frequently Asked Questions
Featured Head-to-Head Comparisons
Popular in Security & Privacy
Temporal AI
Durable execution platform for reliable AI agents and workflows.
FreemiumTry
Push Security
Browser security platform that stops AI-powered attacks and controls AI tool usage.
FreemiumTry
Used Pipelock? Help shape our editorial sentiment research.