Stroq: Check AI coding agent sessions for leaked keys
Added
Made by Agybay Gibatollayev
View profile on GitHub (opens in a new tab)Stroq scans your recent Claude Code and Codex sessions for keys that left your machine.
For developers who use AI coding agents.
What it does
Stroq is a local security tool for AI coding agents. It reads your last 30 days of Claude Code and Codex sessions, shows which commands repeat text your agent read and which keys left your machine, and can add hooks that check each action before it runs.
How to use it
With Node.js installed, run the npx command from the project page to get a card of your own sessions. A second command called init adds hooks that guard your next session, and a console command opens a private page on your machine.
Common use cases
- Run the sent check on your Claude Code and Codex sessions, and you see which key names went to another company, never the key values.
- Run the replay check over the last 30 days of sessions, and you see which commands repeated text your agent had read.
- Add Stroq's hooks to your agent, and a download piped into a shell, or a call carrying a known secret, is denied before it runs.
Can I use this?
Requirements It runs on your own computer from a terminal. It reads your last 30 days of sessions, writes only a small cache and sends nothing. Adding hooks from the console needs macOS or Linux; on Windows use the init command.
Caveat Licensed under Apache-2.0. Old, rotated or unknown keys may be missed, and a local transcript match does not by itself prove delivery to a model provider.
Worth knowing Stroq is a filter, not a sandbox. It matches text, so a command the model writes from scratch does not trace back to a source.
Why it's here
- 213 people have starred it on GitHub.
- Shown on Hacker News (Show HN) on 5 November, with 92 points.
Numbers as of 8 November 2026, from BuildTube’s latest daily refresh.
Behind it
View sourceBuildTube has not run or verified this project. Everything above is written from what the creator published.
Made this?
Quick questions
- What is Stroq?
- Stroq is a local security tool for AI coding agents.
- What can I use Stroq for?
- Run the sent check on your Claude Code and Codex sessions, and you see which key names went to another company, never the key values. Run the replay check over the last 30 days of sessions, and you see which commands repeated text your agent had read. Add Stroq's hooks to your agent, and a download piped into a shell, or a call carrying a known secret, is denied before it runs.
- Can I run Stroq on my computer?
- It runs from a terminal on your own computer. Adding hooks from the console needs macOS or Linux; on Windows use the init command.
- What do I need to use Stroq?
- Node.js 22 or newer and an AI coding agent such as Claude Code, Codex or Cursor. The source says no account is needed and there is no telemetry.
- What license does Stroq use?
- Licensed under Apache-2.0.
More from this week
- agent-desktop Let AI agents read and click desktop apps
For developers building computer-use agents: agent-desktop lets an AI agent read and operate desktop apps on Mac, Windows or Linux from a command line.
- OpenBot Run AI coworkers with their own browser and files
Give an AI coworker a job, connect the tools it needs and watch it work.
- DeepTutor Study your own documents with a personal AI tutor
Read documents with page-by-page citations, practice daily and get video lessons from an AI tutor.
Explore by topic
Post this
Download share imageFor makers
Made this? Show it’s on BuildTube — add the badge to your README or embed the card on your site.
README badge (Markdown)
[](https://buildtube.app/p/gh-aggib-stroq/)Embed card (HTML)
<iframe src="https://buildtube.app/embed/gh-aggib-stroq/" width="560" height="240" style="border:0;max-width:100%" loading="lazy" title="Stroq on BuildTube"></iframe>