When your AI agent has shell access and an API key

What it does

Pipelock is an inline proxy and MCP security control written in Go. It intercepts an AI agent’s outbound HTTP, WebSocket, and MCP traffic to scan for secret exfiltration, SSRF, and prompt injection, then issues cryptographically signed action receipts from a mediator outside the agent process. It can also lock the agent into OS-native process sandboxing on Linux and macOS.

The interesting bit

The receipts are the twist: because they are signed by a mediator external to the agent runtime and its credentials, they act as third-party-verifiable evidence of what actually crossed the network boundary. The design assumes an agent with shell access and API keys can exfiltrate in a single request, so it treats mediation and audit as first-class controls rather than logging afterthoughts.

Key highlights

• 11-layer URL scanner with 62 DLP patterns, SSRF protection with DNS rebinding prevention, and BIP-39 seed phrase detection, all evaluated before DNS resolution
• Bidirectional MCP proxy with tool-call chain detection, poisoned tools/list scanning, and 17 built-in pre-execution policy rules
• Response scanning with 6-pass normalization to catch zero-width characters, homoglyphs, leetspeak, and base64-wrapped prompt-injection payloads
• OS-native sandboxing via Landlock, seccomp, and network namespaces on Linux, plus sandbox-exec profiles on macOS
• Fail-closed kill switch with four independent activation sources including SIGUSR1, sentinel files, and a remote API

Caveats

• The codebase is split-licensed: core is Apache 2.0, but enterprise features fall under ELv2, so check which components you are touching.
• Container sandboxing degrades to a best-effort mode when namespace creation is restricted, falling back to proxy-based routing instead of kernel enforcement.
• Compressed SSE streams are explicitly rejected because compressed bytes evade regex matching, which may break some streaming endpoints.

Verdict

Teams running autonomous AI agents with tool-calling capabilities or MCP servers should evaluate this. If your “AI agent” is just a chatbot wrapper with no file system or shell access, the threat model is overkill.