Pipelock
Pipelock is an open-source agent firewall that mediates MCP, HTTP and WebSocket traffic and signs offline-verifiable receipts.
Most agent firewalls sell blocking and ask you to trust the logs. Pipelock's receipts verify offline — CLI verifiers in Go, TypeScript, Rust and Python, or a browser — which is the part an auditor will actually accept. The tax is operational: a Go binary you configure and sandbox, not a console you log into. Buy Founding Pro at $49/mo when you run several named agent profiles; one profile never leaves the free engine.
Verified 7h ago · liveness 76/100 · cite: rightaichoice.com/tools/pipelock
- Security engineers who need runtime egress control over coding agents with an auditable source tree
- Teams that must produce signed, offline-verifiable evidence for SOC 2, HIPAA or EU AI Act reviews
- Platform teams running many named agent profiles from one self-hosted, flat-rate deployment
- Developers defending against credential exfiltration, prompt injection and poisoned MCP tool responses
- Buyers who want a point-and-click SaaS console with no CLI, Go toolchain or sandbox configuration
- Teams with no AI agents or MCP services in production
- Anyone shopping for a general web application firewall for non-agent HTTP traffic
We scan live Reddit threads, YouTube comments, X posts, G2 reviews and other communities — and hand you an honest verdict in under a minute.
- Honest verdict, not marketing
- Real pros & cons from real users
- Attributed quotes with receipts
3 free scans · no card needed
Skip Pipelock if you want a managed point-and-click security console and have nobody willing to run a Go binary, configure Landlock/seccomp or sandbox-exec, and self-host the proxy.
The free Community tier includes the full security engine but only one default profile, so the moment you need separate policies, budgets, and audit trails for named agents you're onto Founding Pro at $49/mo.
The free Community engine undercuts per-seat gateways for single-profile deployments, and Founding Pro at $49/mo (or $490/yr billed annually) is priced for startups and small teams coordinating multiple named agent profiles — flat regardless of agent count. Enterprise Conductor at $25,000/yr is flat per fleet rather than per seat or per-agent, undercutting seat-metered enterprise AI security platforms at scale, but it's a real commitment versus the $5,000 60-day eval that lets you walk away
In short
Pipelock — Pipelock is an open-source agent firewall that mediates MCP, HTTP and WebSocket traffic and signs offline-verifiable receipts. Best for Security engineers who need runtime egress control over coding agents with an auditable source tree, Teams that must produce signed, offline-verifiable evidence for SOC 2, HIPAA or EU AI Act reviews, Platform teams running many named agent profiles from one self-hosted, flat-rate deployment. Free to start; paid plans from $49/mo.
What's new in Pipelock
Checked 2 days agoAcross the latest 6 updates: 5 changelog entries and 1 news mention.
Pipelock v3.4 Release
Pipelock v3.4 tightens MCP trust policy, scans media request bodies, hardens credential detection, and adds containment-aware upgrades.
Pipelock v3.3 Release
Pipelock v3.3 adds subject-keyed denial-of-wallet budgets, encoded-egress detection, opt-in audit-queue encryption, and SNI-required CONNECT.
Benign Set Should Look Malicious
Argues detection false-positive rate is meaningless if benign set never looks like attack; build hard negatives to stress rules.
Pipelock v3.1 Release
Pipelock v3.1 adds operator dashboard, free evidence viewer, strict receipt verification, SIEM/fleet readiness, and public benchmark-corpus updates.
Pipelock v3.0 Release
Pipelock v3.0 hardens defaults to fail closed, adds signed self-update, provider-key DLP, and Conductor fleet operations.
Pipelock v2.6 Release
Pipelock v2.6 adds operation-level request policy, file-borne injection detection, hook-based agent inspection, and MCP hardening from NSA guidance.
What people actually say about Pipelock — is it worth it?
We ran a structured research pass across product reviews, community discussions, and post-purchase forum threads to surface the patterns vendors won't publish themselves. Below: the recurring strengths, the hidden costs people mention most, and the cohort that consistently regrets adopting this tool.
28 mentions across 4 sources (Hacker News, YouTube, GitHub, Lemmy) · researched Aug 17, 2026.
Average across the 4 sources that answered — each source counts once, not each post.
- +Capability separation: agent lacks network, fetch proxy lacks secrets—clean threat model.
- +Ships signed Ed25519 action receipts for verifiable, offline audit evidence.
- +Flat-rate pricing—no per-seat costs as agent count scales.
- +Open-source Apache 2.0 core, self-hostable, no phone home or machine binding.
- +11-layer scanner covers MCP, HTTP, WebSocket, plus local stdio MCP servers.
- −Only 28 community posts, many off-topic—hard to judge real-world satisfaction.
- −Entropy scan for encoded secrets questioned; methodology may be flawed.
- −No clear answer on multi-agent delegation; sub-agent exfiltration may slip.
- −YouTube results are about mechanical pencils, not the tool—brand confusion.
- −Learning curve is steep; skill level rated intermediate.
- • Self-hosting requires infrastructure setup and maintenance.
- • Paid plans likely involve per-feature or flat-rate costs, but exact pricing is not public.
- • Compliance mapping includes frameworks that may need additional configuration to align.
Viability Score
How well maintained and how widely used is Pipelock? Built from what the vendor actually publishes (docs, changelog, tutorials, integrations, pricing), whether the site is live, and how much real users discuss it. How we calculate this
Last calculated: October 2026
How we score →Key Features
- Agent firewall mediating MCP, HTTP and WebSocket traffic at the agent boundary
- Fixed-order scanner pipeline with 65 DLP credential patterns and checksum validation
- 34 prompt-injection patterns with 6-pass normalization (zero-width, homoglyphs, leetspeak)
- DLP inspection runs before DNS resolution
- SSRF, private-IP and cloud-metadata blocking
- Canary tokens plant a synthetic secret and alert when it moves
- MCP stdio subprocess wrapping with tool poisoning and rug-pull tracking
- MCP tool policy engine with warn, block, redirect or defer actions
- Kill switch OR-composing 7 independent sources, fail-closed by default
- Adaptive escalation with 3 levels, human-in-the-loop approvals, auto-recovery
- Kernel-enforced egress containment via nftables owner-match on Linux
- Process sandbox: Landlock, seccomp and network namespaces on Linux; sandbox-exec (Seatbelt) on macOS
- Ed25519-signed action receipts and hash-chained flight recorder
- Offline receipt verification in Go, TypeScript, Rust, Python and in-browser
- Prometheus and OpenTelemetry (OTLP) metrics export
About Pipelock
Pipelock is an open-source agent firewall from PipeLab: a single Go binary deployed at the agent boundary that mediates every MCP, HTTP and WebSocket request an agent makes, then signs a receipt for what happened. Current release is v3.7.0, which adds parallel receipts and filesystem grants. It targets security engineers and platform teams who need runtime egress control over coding agents plus audit evidence an auditor can verify without trusting the vendor. Install is a git clone pinned to a tag plus `make -C pipelock install` (Go 1.26+, Git and Make required), then `pipelock claude setup` to route Claude Code through the proxy or `pipelock mcp proxy -- ./mcp-server` to wrap a local stdio server. PipeLab ships 18 agent and framework guides, covering Claude Code, Cursor, VS Code, JetBrains, Zed, Codex CLI, Cline, OpenCode, LangGraph, CrewAI, Google ADK, AutoGen and OpenAI Agents. It is listed in the CNCF Landscape under Provisioning · Security & Compliance. Detection is a fixed-order scanner pipeline: 65 DLP credential patterns with checksum and encoding awareness, 34 prompt-injection patterns normalized six ways against zero-width characters, homoglyphs and leetspeak, SSRF and cloud-metadata blocking, canary tokens, and A2A scanning. DLP inspection runs before DNS resolution. MCP controls cover stdio subprocess wrapping, tool poisoning and rug-pull tracking, session binding, chain detection, and a tool policy engine with warn, block, redirect or defer. Enforcement stays fail-closed: a kill switch OR-composes seven independent trigger sources, adaptive escalation scores threats per session across three levels with human-in-the-loop approvals and auto-recovery after clean traffic. The process sandbox uses Landlock, seccomp and network namespaces on Linux and sandbox-exec on macOS. Proof is the other half: Ed25519-signed receipts, a hash-chained flight recorder, and mappings to OWASP MCP Top 10, OWASP Agentic Top 10, MITRE ATLAS, EU AI Act, NIST AI RMF, HIPAA and
Behind the Verdict
The decision on Pipelock turns on one question: do you need to prove what your agents did, or just stop them doing it? If it's the second, cheaper proxies exist and will do the job. If someone will eventually ask you to show the evidence — a SOC 2 auditor, a HIPAA reviewer, an EU AI Act readiness exercise — the signed-receipt chain is the reason to pick this over a plain gateway. We'd reach for it when coding agents touch production credentials. DLP running before DNS means an exfiltration attempt over a URL is caught at the scanner, not after the packet leaves, and the canary-token trick catches the leak you didn't pattern-match. The 27 public demo receipts are worth ten minutes before you install anything — they show allowed reads, blocked metadata reaches and poisoned MCP tool instructions in sequence, which tells you more about the detection model than any feature list. Pass if you want a point-and-click dashboard as the primary interface. This is a compile-and-configure tool, and the install requires Go 1.26+, Git and Make from a clean directory. Teams with no MCP services in production have nothing here to protect. Single-agent setups should stay on Community; Pro's value is named profiles with separate policies, budgets and audit trails, and one profile gets no benefit from it. Recent releases matter for current buyers. v3.5-era work on subject-keyed denial-of-wallet budgets and encoded-egress detection closed gaps that older reviews of this category still cite. v3.4 tightened MCP trust policy and added media request body scanning. v3.0 made fail-closed the default and added provider-key DLP and Conductor fleet operations. If you evaluated Pipelock before v3.0, the defaults you tried have changed. The closest alternative in practice is a general API gateway
Researching Pipelock? Get your full AI stack in 60 seconds.
Free, no signup — tell us your goal and get tools matched to your budget & existing stack.
Real-world workflow fit
Concrete scenarios for the personas Pipelock actually fits — and what changes day-one when you adopt it.
You run `go install` and `pipelock claude setup`, which configures the proxy and starts the scanner, then keep working in Claude Code as normal while DLP and prompt-injection rules inspect every outgoing request before DNS resolution.
Outcome: A leaked API key in an agent-generated URL is blocked at the boundary, and you get a signed receipt plus an evidence view you can open in your browser showing exactly which rule fired.
You wrap each team's local stdio MCP servers with `pipelock mcp proxy -- ./mcp-server`, enable tool poisoning and rug-pull tracking, and plant canary tokens in the environments your agents can reach.
Outcome: A poisoned MCP tool response that tries to exfiltrate a session key over WebSocket gets detected mid-frame, blocked, and recorded in the hash-chained flight recorder for later review.
You run `pipelock assess` to produce a signed assessment, then export signed audit reports in HTML, JSON, and SARIF mapped to SOC 2, EU AI Act, NIST AI RMF, and MITRE ATLAS.
Outcome: The auditor verifies the receipt chain offline with the free Go verifier — no trust in your infrastructure required — and you close the agent-runtime evidence gap without building a bespoke logging pipeline.
Use Cases
- Block credential leaks from Claude Code by scanning outgoing traffic for API keys and tokens
- Enforce MCP tool policies to prevent tool poisoning in agent workflows
- Generate signed audit reports for SOC 2, HIPAA, or EU AI Act evidence during agent runtime assessments
- Constrain agent subprocesses with Landlock, seccomp, and network namespaces on Linux or sandbox-exec on macOS
- Trip the kill switch to deny all mediated egress the moment a prompt injection is detected
- Run `pipelock assess` to produce signed security evidence for a compliance review
- Set subject-keyed denial-of-wallet budgets so one runaway agent can't burn your API spend
- Catch encoded egress that hides a secret inside base64, hex, URL, or Unicode chains
Limitations
- Pipelock is a self-hosted, open-source (Apache-2.0 core) agent firewall, not a hosted proxy: installation is via git clone of the v3.7.0 tag plus make, requiring Go 1.26+, Git and Make, so setup assumes a developer comfortable with binaries and building from source.
- The free Community tier includes the full security engine but only one default security profile; multi-agent coordination with separate policies, budgets and audit trails for named profiles requires Pro at $49/mo, and fleet-wide central governance is Enterprise.
- Signed receipts are only emitted when receipt signing is configured, per the homepage.
- It governs MCP/HTTP/WebSocket traffic at the agent boundary rather than acting as a general web application firewall.
as of 2026-10-03
Verification history
We have re-verified Pipelock 11 times since . Each pass re-reads the vendor's own pages and re-checks every listed field against that evidence; passes where nothing had changed are marked as such.
- — re-verified summary, description, our verdict, our analysis, pricing model, pricing tiers, features, integrations, who it suits, who should skip it
- — re-verified summary, description, our verdict, our analysis, pricing model, pricing tiers, features, integrations, who it suits, who should skip it
- — re-verified summary, description, our verdict, our analysis, pricing model, pricing tiers, features, integrations, who it suits, who should skip it
- — re-verified summary, description, our verdict, our analysis, pricing model, pricing tiers, features, integrations, who it suits, who should skip it
- — re-verified summary, description, our verdict, our analysis, pricing model, pricing tiers, features, integrations, who it suits, who should skip it
- — re-checked, vendor evidence unchanged
Showing the 6 most recent of 11 verification passes.
Free to cite with attribution — this page re-verifies continuously.
12-month cost
Project the real annual outlay, including the implied monthly cost when only an annual tier is published.
Vendor list price only. Add-on usage, seat overages, and contract minimums are surfaced under Hidden costs & gotchas.
Where the pricing makes sense
The company stage and team size where Pipelock's pricing actually pencils out — and where peers do it cheaper.
The free Community engine undercuts per-seat gateways for single-profile deployments, and Founding Pro at $49/mo (or $490/yr billed annually) is priced for startups and small teams coordinating multiple named agent profiles — flat regardless of agent count. Enterprise Conductor at $25,000/yr is flat per fleet rather than per seat or per-agent, undercutting seat-metered enterprise AI security platforms at scale, but it's a real commitment versus the $5,000 60-day eval that lets you walk away
Setup time & first value
How long it actually takes to get something useful out of Pipelock — broken out by persona, not the marketing-page minute.
Solo developer on Claude Code: about two minutes to first value — one `go install` line plus `pipelock claude setup`. Security engineer wrapping stdio MCP servers: 15-30 minutes to wire `pipelock mcp proxy` and tune tool policy. Platform team running named profiles: a few hours to configure separate policies, budgets, and listeners on Founding Pro. Enterprise fleet: expect the $5,000 60-day
Switching to or from Pipelock
How to bring data in from common predecessors and how to get it back out — written for the switcher, not the buyer.
- →From no agent firewall: `go install` plus `pipelock claude setup`, then add MCP stdio wrapping with `pipelock mcp proxy` as you're ready.
- →From a standalone MCP gateway: route the same stdio and HTTP MCP servers through Pipelock's proxy to gain DLP, prompt-injection scanning, and signed receipts on the same path.
- →From cloud provider logging only: keep the provider logs and add Pipelock's hash-chained flight recorder for tamper-evident, offline-verifiable receipts.
- →From per-seat SaaS guardrails: move to the free Community engine for a single profile, then Founding Pro when you need named profiles, at a flat rate independent of agent count.
- ↗To a managed SaaS AI security console: you keep the Apache 2.0 Pipelock engine but move coordination and governance to a hosted control plane with per-seat pricing.
- ↗To per-seat enterprise AI gateways: expect to re-implement named-profile coordination and audit trails under a seat-metered contract rather than Pipelock's flat fleet license.
- ↗To a bespoke in-house proxy and logger: export your existing signed receipts and rule bundles first — Pipelock Rules bundles are signed and portable, but the hash-chained recorder state is not.
Integrations
Resources & Guides
Tutorials & Learning
YouTube returned 6 videos for “Pipelock”, and we withheld 6: 6 could not be judged, because “Pipelock” is a single word that other videos use for other things. We are showing none, because we could not prove any of them are about Pipelock.
Official links
Featured Head-to-Head Comparisons
Pipelock vs Push Security
Choose Push Security if your priority is protecting browser-based interactions (AiTM, ClickFix, session hijacking) and controlling AI tool data leakage across all browsers without forcing a single browser. Choose Pipelock if you run coding agents (Claude Code, Cursor) and need an open-source, kernel-enforced firewall to prevent credential exfiltration and prompt injection with verifiable audit trails.
Pipelock vs Temporal Ai
Pipelock is your choice if you need an open-source agent firewall to prevent secret leaks and prompt injection attacks in coding agents (Claude Code, Cursor) with signed audit trails for compliance. Temporal AI is the pick if you're building durable, fault-tolerant AI workflows or multi-step microservices that survive crashes and retries — its durable execution SDKs are battle-tested at scale. They solve different problems: Pipelock secures agent egress, Temporal orchestrates agent logic.
Pipelock vs Audioeye
Pipelock and AudioEye solve completely different problems. Choose Pipelock if you run coding agents (Claude Code, Cursor) and need runtime guardrails against secret leaks, prompt injection, and unauthorized egress with signed audit trails. Choose AudioEye if you need ADA/WCAG compliance for a public website with automated scanning, overlays, and legal support. They are not direct competitors; pick based on your primary threat model.
Popular in AI Governance & Guardrails
Mindgard
Mindgard automates AI red teaming — agent-native reconnaissance, exploit validation, and continuous AI security testing for production AI
Poolside AI
Poolside builds open-weight agentic coding models — Laguna XS 2.1 (33B) and Laguna S 2.1 (118B) — for code that stays inside your security
Olas Network
Co-own autonomous AI agents on-chain: stake OLAS, run agents that trade, hire each other and settle payments.
Frequently Asked Questions
Categories
Best-of guides
Topics
Used Pipelock? Help shape our editorial sentiment research.