What is Stroq?
Stroq sits between a coding agent and its tools. Its hooks read each tool call before it runs and compare it with what the agent has read in the session so far: a fetched page, an issue, a file, a command's output. A command that repeats text from that material gets a question naming the source; `curl | sh` and outbound calls carrying a secret found on your machine are denied. Native hooks exist for Claude Code, Cursor, Codex, Copilot CLI, Windsurf and Antigravity, with a plugin for OpenClaw and a stdio proxy for MCP servers.
It also works backwards. `npx @stroq/cli replay --all` runs your Claude Code sessions from the last 30 days through today's policy without installing anything, and `stroq sent` checks Claude Code, Codex and Cursor transcripts against the credentials on your disk and reports, by name only, where each key went. A console on 127.0.0.1 shows decisions and which agent settings weaken the hooks. The project describes itself as a filter, not a sandbox: it reads tool calls, it does not isolate files, network or processes.
Is Stroq worth it?
The most useful thing Stroq does needs no installation. `npx @stroq/cli replay --all` reads your own Claude Code transcripts from the last 30 days and shows which commands repeated text the agent had just read from a page, an issue or a file, and which would be stopped today. Nothing runs and nothing is sent, according to the README, and only a small cache is written under ~/.stroq.
The live hooks apply the same reading before each tool call. Version 0.32.0, released on 11 November 2026, ships 622 rules. The project's own attack suite replays 36 attacks from public reports and synthetic cases; on 0.30.0, 15 were denied, 21 were asked about and none passed. Its false-positive bench, run over 121 ordinary README and documentation files, flags 6, or 5.0%, down from 14.9% before a 1 November rule change. Both figures are measured by the maintainers on corpora they publish, not by a third party, and the bench page says so.
What it can see is limited by what the host sends. Matching is on text, so a command the model writes from scratch does not trace back to a source, and a script the agent runs is just `npm test` to the hook. Codex and Windsurf hooks cannot ask a question, so there the answer is a refusal until you trust the folder. Scans have a 4,000 ms budget and fail closed as suspect when it runs out. Inside a sandbox, the hook needs read and write access to ~/.stroq or every shell command, edit, fetch and MCP call is refused.
The catch: this is a young project, created on 4 September 2026, with 249 stars, 859 commits and four human contributors, most of the work by one developer. npm counted 906 downloads in the week to 12 November. It changes fast, and an older install line could let calls through when the hook failed to start, a gap fixed in 0.32.0 only after you rerun `stroq init`.
Our take: think of it as a smoke detector, not a fire door; run the replay audit on your history this week, and keep the hooks on if your agent fetches pages or reads issues from strangers, with a container or separate user account around anything that runs untrusted code.
Where it earns its place
A developer who has used Claude Code daily for a month
Find out whether any past session ran something an issue or web page told it to
Run `npx @stroq/cli replay --all` and then `npx @stroq/cli sent`; the first lists sessions worth opening, the second names which keys appeared in commands or model input. It costs nothing and changes nothing on disk beyond the cache.
A maintainer triaging outside pull requests with an agent
Stop the agent running an install line it read in a stranger's README
`stroq init` adds hooks to Claude Code; `stroq inspect` reads a cloned folder first and points at code that runs itself. Pair it with a container, since a hook cannot see what the repository's own scripts do.
A security lead at a small engineering team
See which agent settings on a laptop weaken the guard
The console on 127.0.0.1 lists each agent, whether its hooks are actually called, every decision with its rule, and the skills and MCP servers installed. It needs no account; adding hooks from the console needs macOS or Linux.
Before you commit
- Setup
- Needs Node.js 22 or newer. `npx @stroq/cli` prints a summary card of the last 30 days; `npx @stroq/cli init` installs the hooks into your agents.
- Integrations
- Claude Code, Cursor, Codex CLI, Copilot CLI, Windsurf and Antigravity hooks; an OpenClaw plugin; a stdio MCP proxy; JSON output from the card.
- Data and privacy
- Reads session transcripts, key files and working folders locally and prints key names, never values. Writes its policy, audit log and cache to ~/.stroq. The hooks make no outbound network calls and there is no telemetry.
- Cost at scale
- Free for any number of machines; the cost is the occasional question it asks and the rule tuning when it flags something benign.
- Limits
- Sees only what each agent's hook API passes it, which varies by agent and version. Text-level matching; 4,000 ms scan budget per call; it is a filter, not a sandbox.
What’s good
- `replay --all` audits past Claude Code sessions with nothing installed
- Names the text a suspicious command was copied from
- Hooks for six agents plus an MCP stdio proxy; no network calls from the hooks
- Publishes its own false-positive rate and method
What’s not
- Text matching misses commands the model writes from scratch
- Codex and Windsurf hooks can only refuse, not ask
- Does not isolate files, network or processes
- Small, fast-moving project with about 249 stars
Best for
Developers who let Claude Code, Codex or Cursor read web pages, issues or cloned repositories and want a warning when the agent acts on what it read.
Stroq alternatives
Stroq: common questions
- Is Stroq worth it?
- Stroq is a sensible second line of defence for anyone whose agent reads the web, and its retroactive audit of past sessions is worth running once even if you never install the hooks, but it is a text filter from a small team and not a substitute for a sandbox. We rate it 3.8 out of 5.
- How much does Stroq cost?
- Free and open source (Apache-2.0). No account, no telemetry.
- What are the downsides of Stroq?
- Text matching misses commands the model writes from scratch; codex and Windsurf hooks can only refuse, not ask; does not isolate files, network or processes; small, fast-moving project with about 249 stars.
- Who is Stroq best for?
- Developers who let Claude Code, Codex or Cursor read web pages, issues or cloned repositories and want a warning when the agent acts on what it read.
- How much does Stroq cost for a team or in production?
- Free for any number of machines; the cost is the occasional question it asks and the rule tuning when it flags something benign.
- Is Stroq safe for company data?
- Reads session transcripts, key files and working folders locally and prints key names, never values. Writes its policy, audit log and cache to ~/.stroq. The hooks make no outbound network calls and there is no telemetry.
- What are the best Stroq alternatives?
- The closest alternatives we have reviewed are CC Safety Net, LlamaFirewall and Anthropic Sandbox Runtime (srt).
Answers checked Nov 13, 2026.