Stroq
Finds leaked secrets in AI coding agent sessions
Visit website →About
Stroq is an open-source security tool that audits your AI coding agent sessions (Claude Code, Codex, Cursor) and finds any secrets that leaked during work. It runs locally with no telemetry, no account required, and sends nothing externally.
Stroq works through two hooks: one audits what the agent reads from files and text, the other decides whether the next action is safe before execution. When an agent tries to send an API key externally, Stroq blocks it and tells you why, naming the file that triggered the command.
It ships with 36 known attacks from public reports and replays them against your policy to verify effectiveness. Results: 15 attacks blocked, 21 ask first, nothing passes without review. Supports Claude Code, Cursor, Codex, Copilot CLI, Windsurf, and more.
For anyone working with coding agents on real projects, Stroq is an essential security layer. It finds leaked secrets, blocks dangerous commands, and shows you the source of every action with full transparency.
AI-assisted draft, human-reviewed before publishing — see how we choose & review tools.
Why we picked it
With coding agents everywhere, attacks through real files and text are a real problem. Stroq doesn't just audit commands — it traces their source, a feature traditional security tools lack.
Related tools
- 1 Rystic Realistic local API simulators for testing AI agents Freemium
- 2 Superfik Open-source canvas to watch AI coding agents work — each on its own card Free
- 3 Momentic AI QA engineer that catches bugs before they ship Freemium
- 4 Verdict Local model verifying CLI outcomes for AI agents. Exit code 0 ≠ proof Free
- 5 Backenly Autonomous backend your coding agent builds over MCP and keeps running Freemium
- 6 Overmind Train specialized models from your agent's production traces Freemium