AI Skill Hub 强烈推荐:pipelock MCP工具 是一款优质的AI工具。AI 综合评分 8.2 分,在同类工具中表现稳健。如果你正在寻找可靠的AI工具解决方案,这是一个值得深入了解的选择。
pipelock MCP工具 是一款基于 Go 开发的开源工具,专注于 MCP安全、代理防火墙、DLP防护 等核心功能。作为 GitHub 开源项目,它拥有活跃的社区支持和持续的版本迭代,代码完全透明可审计,支持本地部署以保护数据隐私。无论是个人使用还是集成到企业工作流,都能提供稳定可靠的解决方案。
pipelock MCP工具 是一款基于 Go 开发的开源工具,专注于 MCP安全、代理防火墙、DLP防护 等核心功能。作为 GitHub 开源项目,它拥有活跃的社区支持和持续的版本迭代,代码完全透明可审计,支持本地部署以保护数据隐私。无论是个人使用还是集成到企业工作流,都能提供稳定可靠的解决方案。
# 方式一:go install(推荐) go install github.com/luckyPipewrench/pipelock@latest # 方式二:从源码编译 git clone https://github.com/luckyPipewrench/pipelock cd pipelock go build -o pipelock . # 方式三:下载预编译二进制 # 访问 Releases 页面下载对应平台二进制文件 # https://github.com/luckyPipewrench/pipelock/releases
# 查看帮助 pipelock --help # 基本运行 pipelock [options] <input> # 详细使用说明请查阅文档 # https://github.com/luckyPipewrench/pipelock
# pipelock 配置说明 # 查看配置选项 pipelock --config-example > config.yml # 常见配置项 # output_dir: ./output # log_level: info # workers: 4 # 环境变量(覆盖配置文件) export PIPELOCK_CONFIG="/path/to/config.yml"
<p align="center"> <strong>Open-source AI agent firewall for <a href="https://pipelab.org/learn/verifiable-egress-control/">Verifiable Egress Control</a>.</strong> </p>
<p align="center"> <a href="https://github.com/luckyPipewrench/pipelock/actions/workflows/ci.yaml"><img alt="CI" src="https://github.com/luckyPipewrench/pipelock/actions/workflows/ci.yaml/badge.svg"></a> <a href="https://github.com/luckyPipewrench/pipelock/actions/workflows/security.yaml"><img alt="Security" src="https://github.com/luckyPipewrench/pipelock/actions/workflows/security.yaml/badge.svg"></a> <a href="https://github.com/luckyPipewrench/pipelock/actions/workflows/continuous-gauntlet.yaml"><img alt="Gauntlet exam" src="https://github.com/luckyPipewrench/pipelock/actions/workflows/continuous-gauntlet.yaml/badge.svg"></a> <a href="go.mod"><img alt="Go 1.25+" src="https://img.shields.io/github/go-mod/go-version/luckyPipewrench/pipelock?logo=go&label=Go"></a> <a href="https://github.com/luckyPipewrench/pipelock/releases"><img alt="Release" src="https://img.shields.io/github/v/release/luckyPipewrench/pipelock"></a> </p>
<p align="center"> <a href="https://scorecard.dev/viewer/?uri=github.com/luckyPipewrench/pipelock"><img alt="OpenSSF Scorecard" src="https://api.scorecard.dev/projects/github.com/luckyPipewrench/pipelock/badge"></a> <a href="https://www.bestpractices.dev/projects/11948"><img alt="OpenSSF Best Practices" src="https://www.bestpractices.dev/projects/11948/badge"></a> <a href="https://codecov.io/gh/luckyPipewrench/pipelock"><img alt="codecov" src="https://codecov.io/gh/luckyPipewrench/pipelock/graph/badge.svg"></a> <a href="https://github.com/luckyPipewrench/pipelock/blob/main/.github/workflows/ci.yaml#L21-L35"><img alt="pipelock self-scanned" src="https://img.shields.io/badge/pipelock-self--scanned-00FFC8?style=flat&labelColor=1A1A2E&logo=data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAxNCAxNCI+PHBhdGggZmlsbD0iIzAwRkZDOCIgZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik03IDAuNWMtMS45MyAwLTMuNSAxLjY2LTMuNSAzLjd2MS4zSDNjLS44MyAwLTEuNSAuNjctMS41IDEuNXY2YzAgLjgzLjY3IDEuNSAxLjUgMS41aDhjLjgzIDAgMS41LS42NyAxLjUtMS41VjdjMC0uODMtLjY3LTEuNS0xLjUtMS41aC0uNVY0LjJjMC0yLjA0LTEuNTctMy43LTMuNS0zLjdabS0yIDVWNC4yYzAtMS40OSAxLjEyLTIuNyAyLjUtMi43czIuNSAxLjIxIDIuNSAyLjd2MS4zSDVaTTIuNSA1aDJ2MS4yaC0yVjVabTcgMGgydjEuMmgtMlY1Wk03IDguMmMtLjY5IDAtMS4yNS41Ni0xLjI1IDEuMjUgMCAuNDQuMjMuODMuNTcgMS4wNXYxLjVoMS4zNnYtMS41Yy4zNC0uMjIuNTctLjYxLjU3LTEuMDUgMC0uNjktLjU2LTEuMjUtMS4yNS0xLjI1WiIvPjwvc3ZnPgo="></a> </p>
<p align="center"> <a href="LICENSE"><img alt="Core Apache 2.0" src="https://img.shields.io/badge/Core-Apache_2.0-blue.svg"></a> <a href="enterprise/LICENSE"><img alt="Enterprise ELv2" src="https://img.shields.io/badge/Enterprise-ELv2-orange.svg"></a> <a href="https://landscape.cncf.io/?item=provisioning--security-compliance--pipelock"><img alt="CNCF Landscape: Security & Compliance" src="https://img.shields.io/badge/CNCF%20Landscape-Security%20%26%20Compliance-1a73e8?logo=cncf&logoColor=white"></a> <a href="https://discord.gg/badNfhGKTc"><img alt="Discord" src="https://img.shields.io/badge/Discord-Join%20the%20community-5865F2?logo=discord&logoColor=white"></a> </p>
Pipelock sits between AI agents and the network. It inspects mediated HTTP, WebSocket, MCP, and A2A traffic, plus CONNECT tunnel contents when TLS interception is enabled, for secret exfiltration, prompt injection, SSRF, tool poisoning, and risky tool-call chains. Plain CONNECT without interception is scanned at the hostname and URL level.
Pipelock emits mediator-signed action receipts over content-aware boundary decisions, so a reviewer can verify what Pipelock decided outside the agent runtime. The public agent-egress-bench corpus exercises the detections. The Gauntlet workflow is the product's scheduled candidate exam against a pinned corpus commit; it does not auto-publish a public score. Learn more: Open-source AI firewall.
Works with: Claude Code · OpenAI Codex · Cline · OpenCode · Pi · Zed · Cursor · VS Code · JetBrains · OpenAI Agents SDK · Google ADK · AutoGen · CrewAI · LangGraph
<p align="center"> <a href="#the-problem">Problem</a> · <a href="#verify-it-yourself">Verify</a> · <a href="#quick-start">Quick Start</a> · <a href="#see-it-in-action">Action</a> · <a href="#what-it-catches">Catches</a> · <a href="#what-it-does">Features</a> · <a href="#how-it-works">Architecture</a> · <a href="#docs">Docs</a> · <a href="https://pipelab.org/playground">Playground</a> · <a href="https://pipelab.org/blog/">Blog</a> · <a href="https://app.dosu.dev/bcccd1cf-be85-4c0e-ae05-edeb0ff50b59/ask">Ask Dosu</a> </p>
<p align="center"> <strong>Try it in your browser at the <a href="https://pipelab.org/playground">live playground</a>. If Pipelock earns it, <a href="https://github.com/luckyPipewrench/pipelock/stargazers">star the repo</a> so other people find it.</strong> </p>
---
git clone --branch v3.5.0 --depth 1 https://github.com/luckyPipewrench/pipelock.git make -C pipelock install
docker pull ghcr.io/luckypipewrench/pipelock:3.5.0
```bash
docker pull ghcr.io/luckypipewrench/pipelock:3.5.0 docker run -p 8888:8888 -v ./pipelock.yaml:/config/pipelock.yaml:ro \ ghcr.io/luckypipewrench/pipelock:3.5.0 \ run --config /config/pipelock.yaml --listen 0.0.0.0:8888
pipelock generate docker-compose --agent claude-code -o docker-compose.yaml docker compose up
```bash
.claude.json configurationmcp.jsonhttpProxy setup with a named agent listener (example)context_servers block in settings.jsonMCPServerStdio, multi-agent handoffsMcpToolset, StdioConnectionParamsStdioServerParams, mcp_server_tools()MCPServerStdio wrapping, MCPServerAdapterMultiServerMCPClient, StateGraphpipelock cursor install registers Pipelock as a Cursor hook for shell execution, MCP tool calls, and file reads; use --config to embed a validated policy path and pipelock cursor remove to remove Pipelock-managed hooks. You can also use configs/cursor.yaml with the same MCP proxy pattern as Claude Code (walkthrough)pipelock vscode install rewrites .vscode/mcp.json to route every MCP server through the MCP proxy; --global targets the user-level mcp.jsonpipelock generate mcporter reads any JSON file with a top-level mcpServers object and wraps every server through Pipelock's proxy, so a client that is not on the list above still routes through scanning in one command.---
The examples/tool-response-injection/ harness runs an end-to-end demo where an MCP tool with a harmless name and description hides a prompt-injection payload in its response. Pipelock blocks the response before it reaches the agent and emits signed action receipts that a third party can verify. The same demo runs against three transports with one shared signing key:
cd examples/tool-response-injection
python3 demo.py # needs python3 + cryptography + pipelock on PATH
---
pipelock init
Generate a config from a built-in preset, or let pipelock audit tailor one to your project:
pipelock presets
pipelock generate config --list
pipelock generate config --preset balanced > pipelock.yaml
pipelock audit ./my-project -o pipelock.yaml
| CLI Preset | Mode | Action | Best For |
|---|---|---|---|
balanced | balanced | warn | General purpose (default) |
strict | strict | block | High-security, regulated industries |
audit | audit | warn | Log-only evaluation |
claude-code | balanced | block | Claude Code unattended |
cursor | balanced | block | Cursor IDE |
generic-agent | balanced | warn | New agents during tuning |
hostile-model | strict | block | Uncensored/abliterated models |
Config changes are picked up through file watcher or SIGHUP. Full reference: docs/configuration.md
For false positive tuning: docs/false-positive-tuning.md
---
```yaml
- uses: luckyPipewrench/pipelock@ca05ed06f360f5aac5518ab6ea2b11d729b70bee # v3.5.0 with: scan-diff: 'true' fail-on-findings: 'true' ```
The action downloads a pre-built binary, runs pipelock audit, scans the PR diff for leaked secrets, and uploads the audit report as a workflow artifact. See examples/ci-workflow.yaml for a complete workflow.
| Pipelock | Scanners (agent-scan) | Sandboxes (srt) | Kernel agents (agentsh) | |
|---|---|---|---|---|
| Secret exfiltration prevention | Strict blocks; balanced detects | Partial (proxy mode) | Partial (domain-level) | Yes |
| DLP + entropy analysis | Yes | No | No | Partial |
| Prompt injection detection | Yes | Yes | No | No |
| MCP scanning (bidirectional + tool poisoning) | Yes | Yes | No | No |
| WebSocket proxy (frame scanning) | Yes | No | No | No |
| MCP HTTP transport (Streamable HTTP) | Yes | No | No | No |
| Emergency kill switch (6 sources) | Yes | No | No | No |
| Tool call chain detection | Yes | No | No | No |
| Process sandbox (no Docker) | Yes | No | No | Yes (kernel-level) |
| Single binary, no runtime deps | Yes | No (Python) | No (npm) | No (kernel) |
Reference matrix: docs/comparison.md
Canonical comparison hub: AI runtime security comparison
<details> <summary>OWASP Agentic Top 10 Coverage</summary>
| Threat | Coverage |
|---|---|
| ASI01 Agent Goal Hijack | **Strong:** bidirectional MCP + response scanning |
| ASI02 Tool Misuse | **Partial:** proxy as controlled tool, MCP scanning |
| ASI03 Identity & Privilege Abuse | **Strong:** capability separation + SSRF protection |
| ASI04 Supply Chain Vulnerabilities | **Partial:** integrity monitoring + MCP scanning |
| ASI05 Unexpected Code Execution | **Moderate:** HITL approval, fail-closed defaults |
| ASI06 Memory & Context Poisoning | **Moderate:** injection detection + session taint propagation |
| ASI07 Insecure Inter-Agent Communication | **Partial:** MCP/A2A scanning, agent ID, integrity, signing |
| ASI08 Cascading Failures | **Moderate:** fail-closed architecture, rate limiting |
| ASI09 Human-Agent Trust Exploitation | **Partial:** HITL modes, audit logging |
| ASI10 Rogue Agents | **Strong:** domain allowlist + rate limiting + capability separation |
Details, config examples, and gap analysis: docs/owasp-mapping.md
</details>
---
Pipelock 是一个强大的安全审计与防护工具,旨在为开发流程提供全方位的安全保障。通过集成先进的审计机制,它能够帮助开发者识别潜在风险并生成详细的安全报告,确保代码与工具链的安全性。
Pipelock 提供丰富的安全功能:支持通过 `pipelock report` 生成包含风险评级、时间线及证据附录的 HTML/JSON 审计报告,并支持使用 Ed25519 进行签名;内置 `pipelock diagnose` 命令,可在无需网络的情况下运行 7 项本地检查,确保配置端到端正常工作;此外还具备强大的安全强制执行能力。
用户可以直接下载预编译的二进制文件使用,无需安装任何依赖。若希望从源码构建,则需要环境安装有 Go 1.25+ 版本。此外,项目支持通过 GitHub Attestation 进行 SLSA 溯源与 SBOM 验证,以确保发布版本的完整性与安全性。
您可以通过多种方式安装 Pipelock:使用 Homebrew 执行 `brew install luckyPipewrench/tap/pipelock` 进行快速安装;对于容器化环境,可以通过 `docker pull ghcr.io/luckypipewrench/pipelock:latest` 获取 Docker 镜像;也可以根据需求进行自定义部署。
本项目提供了丰富的集成指南,支持将 Pipelock 作为 MCP proxy 接入多种主流 AI 开发工具,包括 Claude Code、OpenAI Codex、Cline、OpenCode 以及 Zed 编辑器。通过配置相应的 `.claude.json` 或 `mcp.json`,您可以轻松实现安全代理与沙箱集成。
使用 Pipelock 前需通过 `pipelock init` 进行初始化。您可以利用 CLI 预设(如 `balanced` 模式)生成配置文件,或者直接运行 `pipelock audit` 根据当前项目需求自动定制 `pipelock.yaml`。系统会���动识别 IDE 配置并确保配置文件的安全性。
Pipelock 提供了一个专门的扫描 API 端点,支持程序化扫描。任何工具、流水线或控制平面都可以通过提交 URL、文本或 Tool Call 来获取结构化的判定结果。API 支持四种扫描类型:`url`、`dlp`、`prompt_injection` 以及 `tool_call`,且无需将代理置于请求路径中。
Pipelock 深度集成 CI/CD 工作流,支持在 GitHub Actions 中通过 `luckyPipewrench/pipelock@v2` 直接调用。它能够自动下载二进制文件并执行 `pipelock audit`,扫描 PR Diff 中的敏感信息泄露情况,并将生成的审计报告作为 Workflow Artifact 上传,实现自动化的安全合规检查。
专业的MCP安全解决方案,针对AI代理的典型安全威胁提供综合防护。活跃维护、技术方向清晰,是构建安全AI系统的关键基础设施。
AI Skill Hub 为第三方内容聚合平台,本页面信息基于公开数据整理,不对工具功能和质量作任何法律背书。
建议在沙箱或测试环境中充分验证后,再部署至生产环境,并做好必要的安全评估。
✅ Apache 2.0 — 宽松开源协议,可商用,需保留版权声明和 NOTICE 文件,含专利授权条款。
总体来看,pipelock MCP工具 是一款质量优秀的AI工具,在同类工具中具备一定竞争力。AI Skill Hub 将持续追踪其更新动态,建议收藏备用,结合自身场景选择合适时机引入使用。
| 原始名称 | pipelock |
| 原始描述 | 开源MCP工具:Open-source AI agent firewall for MCP security: agent egress control, DLP, SSRF,。⭐589 · Go |
| Topics | MCP安全代理防火墙DLP防护SSRF防御开源安全 |
| GitHub | https://github.com/luckyPipewrench/pipelock |
| License | Apache-2.0 |
| 语言 | Go |
收录时间:2026-05-17 · 更新时间:2026-05-19 · License:Apache-2.0 · AI Skill Hub 不对第三方内容的准确性作法律背书。