Show HN: Pipelock – All-in-one security harness for AI coding agents
https://github.com/luckyPipewrench/pipelock
I'm a plumber who taught himself to code. I run a plumbing company during the day and mess with my homelab at night. About a year ago I started running AI agents with full shell access and API keys to help manage my business. Scheduling, invoicing, monitoring my K3s cluster.It worked great until I realized nothing was stopping those agents from sending my credentials anywhere. I had API keys for Slack, email, cloud services, all sitting in environment variables that any tool call could exfiltrate. Static scanners check code before you install it, but they can't catch a trusted tool that decides to phone home at runtime.
So I built Pipelock. Single Go binary, sits between your AI agent and the outside world.
What it does:
- Scans all outbound traffic for secrets (API keys, tokens, passwords) and blocks them before they leave
- Blocks network access to unauthorized destinations (SSRF protection)
- Wraps MCP servers as a stdio proxy, scanning responses for prompt injection
- Monitors your workspace files for unauthorized changes The hard part was making it fast enough that you don't notice it's there. Every HTTP request runs through regex matching and entropy analysis. I spent a lot of time getting the scanning pipeline under a few milliseconds of latency. The MCP proxy was trickier. Intercepting JSON-RPC stdio streams in real time without breaking the conversation flow when something gets flagged took some iteration.
I run it daily on my own setup. My AI assistant manages Slack messages, queries our job management API, checks email, and monitors my Kubernetes cluster. Pipelock sits in front of all of it. Last week it caught a skill that was embedding my Slack token in a debug log heading to an external endpoint. Never would have noticed without the DLP scanner.
Snyk recently found that 283 out of 3,984 published agent skills (about 7%) were leaking credentials. That's the problem space. Static scanning catches malware. Runtime scanning catches everything else.
Try it:
brew install luckyPipewrench/tap/pipelock pipelock generate config --preset balanced -o pipelock.yaml pipelock proxy start --config pipelock.yaml
Demo: https://asciinema.org/a/I1UzzECkeCBx6p42
Curious for feedback on the detection approach. Exfiltration patterns I'm missing, whether the MCP proxy is useful to people running coding agents, and what breaks if you try it.
HN: > created: 1 day ago
https://asciinema.org/~user%3A281302 > Joined on February 9, 2026
pipejosh is totally a real person!
Because a plumber would definitely first and foremost plug his AI software and not his plumbing company, which definitely exists!
How does this make it to the frontpage in <1 hour from posting?
P.S. https://pipelab.org/ has a bad cert
> Exfiltration patterns I'm missing
I was wondering about these entropy-based approaches. If I can make the AI agent run arbitrary python code, and I have access to the secrets, then I can make an infinite amount of encoders that have low "local" entropy, but would still be decodable into your secret. A few examples:
- Take 16 random words longer than `N` characters, encode each 4-bit nibble of the secret into this encoding. The output can be [in order, the 16-word dictionary][word1 word2 word3 word4... wordX]
- Repeat each character of a password N times, separate by spaces, e.g. password `hunter1` becomes `hhhhhhhh uuuuuuuu nnnnnnn ttttttt eeeeeee rrrrrrr 1111111`.
Potentially the LLM might even be able to do these encodings without a script.
Besides the regular network-level blocking, and some simple regex to catch most properly formatted API keys and other credentials, is this worth protecting against? Considering also the more complex the exfiltration patterns to filter for, the higher the amount of false positives.
Ok so how does this "Entropy scan" work?
Apparently by defining "bits per character"
https://github.com/luckyPipewrench/pipelock/blob/3021f023b0e...
So I guess converting the secret to pure binary will evade the "entropy scanner"?
Credential scanning seems tractable. There’s a large body of work around scanning for credentials in repos to prevent leakage via GitHub.
If speed really matters, you could minimize the patterns you check by integrating credential management. By definition, you know all the secrets you’re trying to protect. Look for _exactly_ those rather than regex which try to enumerate the general case.
Still, solving credential leakage is necessary but not sufficient. There’s other sensitive information in your context: customer contact information, costs & pricing, snarky slack conversations. That stuff could show up anywhere online your agent can post. Like Google Reviews.
The structural problem is that Enumerate Badness is always incomplete but it’s impossible to Enumerate Goodness for a generative system. The only solution I see is to allowlist resources at the network level and assume 100% cross contamination.
This article helped shape my thinking on this topic:
The Six Dumbest Ideas in Computer Security
https://www.ranum.com/security/computer_security/editorials/...
curious about one gap though: how does pipelock handle agents that spawn other agents? in multi-agent setups, agent A might schedule agent B through a cron job, task queue, or even just writing a shell script that runs later. the integrity monitor catches file changes, but by the time you detect the new script, the spawned agent might already be running with inherited env vars and no proxy in front of it.
do you see the MCP proxy as the answer there — wrapping every possible execution path — or is there a different approach for controlling the blast radius of agent chains?