Show HN: Stroq – a local audit of what your coding agent did and why

Who Should Read

Developers who let Claude Code, Codex or Cursor work on machines holding API keys and worry about leaks or prompt injection

Core Mechanics

• Audits past sessions with no install
  • `npx @stroq/cli` reads your last 30 days of sessions, key files and working folders.
  • It prints key names, never values, and sends nothing.
• Classifies where each key went
  • `stroq sent` compares Claude Code, Codex CLI and Cursor sessions with credentials on your machine.
  • Buckets are sent to another company, maybe sent, seen by the AI, used with its own service, and blocked before it ran.
• Traces commands back to their source
  • Hooks judge every tool call before it runs.
  • They deny `curl | sh` and outbound calls carrying a known secret.
  • They ask first when a command repeats text the agent read, naming that text.
• Replays history against today's policy
  • `stroq replay --all` checks Claude Code sessions from the last 30 days with no hooks needed.
  • Verdicts come from today's policy, not a record of what happened then.
• Reproduces 36 attacks in a sandbox
  • `stroq attack` runs 36 attacks from public reports and synthetic cases in a throwaway home.
  • On 0.30.0, 15 are denied, 21 are asked about, 0 pass through.
• States its own limits
  • Matching is text-level, so commands the model writes from scratch can't be traced.
  • It is a filter, not a sandbox, and keys can leave via scripts, files or variables unseen.

Community Reactions

• Don't rely on the host harness
  • One commenter runs agents in full gVisor isolation with a default-deny egress proxy that injects secrets.
  • It suspends on outbound connections and lets the user decide, and they won't trust the harness tool boundary alone.
• Suggestion to use an eBPF backend
  • A commenter said eBPF would cover many more adversarial scenarios.
  • It needs Linux, but they argue dev should happen in a VM anyway, and linked agentsight.
• Is it rules rather than an LLM?
  • Two commenters asked whether, since matching is text-level and nothing is sent out, it judges by rules rather than an LLM.
  • One hoped it could become part of a prompt injection warning system.
• Menubar daemon idea
  • A commenter suggested a background daemon that scans continuously and alerts from a menubar app.
  • Clicking an entry would allow redact, delete, repair or mark as false positive.

How to Apply

• Check your sessions for leaked keys today
  • Run `npx @stroq/cli sent` in a terminal.
  • Rotate any key reported as sent to another company right away.
• Replay old sessions against current policy
  • Run `npx @stroq/cli replay --all` to check the last 30 days without installing hooks.
  • Open the sessions it flags with `stroq show`.
• Turn on hooks to guard the next session
  • After reviewing results, run `npx @stroq/cli init` to hook into your agent.
  • Use Test hook in the console to confirm the hook is actually called.
• Pair it with real isolation
  • It is a filter, not a sandbox, so keep sensitive keys out of the agent's working environment.
  • Run agents inside a VM or container.

Try It

# Paste into your terminal (requires Node.js 22+)

npx @stroq/cli

# See where your keys went (key names only, never values)
npx @stroq/cli sent

# Replay the last 30 days of sessions against current policy, no hooks needed
npx @stroq/cli replay --all

# Next: run the 36 attacks in a sandbox, then hook in if you like it
npx @stroq/cli attack
npx @stroq/cli init

Terminology

Related Papers

• Claude Code sends your email address to websites

  Claude Code put users' emails in curl User-Agent headers, prompting spam complaints and a built-in blocking mod

• Launch HN: Rivet (YC W23) – Scale and Orchestrate Agents on S3

  Running each agent as an Actor gave 4.99 ms p99 cold starts and 72 KB RAM per instance.

• Building a Multi-Agent System from Scratch: Architecture Patterns

  Splitting work across agents adds coordination problems, so enforce hard limits in code.

• On Turn-Level Best-of-N Sampling for Scaling LLM Agents

  Picking one of N candidate actions per turn with an LLM raised pass@1 and cut agent turns by 40–50%.

• When Do Summaries Become Instructions? Unsupported Policy in LLM Agents' Self-Written Handoff Summaries

  Making the system prompt's approval sentence specific cut unsupported restrictions in agent summaries from 5.0% to 1.8%.

• AI is forcing us to pay off 40 years of technical debt

  AI turned an old PHP crash bug into a code-execution exploit within two weeks.

• Postman silently auto-installs AI plugins and attempts to share all API data

  Opening Postman auto-installed plugins and a startup hook into Codex and Claude Code

• Octomind – open-source AI harness that saves your tokens, static rust

  A single Rust binary runs any model as a coding agent, with TOML guardrails replacing approval prompts.

Related Resources

• https://github.com/AGGIB/Stroq
• https://stroq.dev
• https://eunomia.dev/agentsight/