Stroq

Who is really in charge of your agent?

Stroq reads your own Claude Code and Codex sessions and shows how many commands came from text your agent read, and which keys left your machine.

An example: a made-up machine with made-up sessions, keys and hosts. Hoo is Stroq's owl. Your card shows your own sessions.

It reads your last 30 days of sessions, your key files and the folders your agent worked in; prints key names, never values; writes nothing but a small cache under ~/.stroq; and sends nothing. No account, no telemetry.

Every moment on the card has a stroq show line that prints the evidence behind it (npx @stroq/cli show 1). stroq help --all lists the other commands. Needs Node.js 22 or newer. Apache-2.0.

Beyond the card

Stroq is a local security platform for AI coding agents: Claude Code, Cursor, Codex CLI and others. Its hooks judge every tool call before it runs. They deny curl | sh and outbound calls that carry a known secret from your machine, and they ask you first when a command repeats text the agent read, naming that text. The console shows which agents actually ask Stroq, and every decision with its reason. Sessions you already had can be checked too, without installing anything.

A made-up machine: made-up sessions, keys and hosts. Nothing was executed.

The console

Check: the card of stroq, made by the same code. Each moment opens with its evidence, under it one line for each agent.
Live: recorded decisions as they happen. A row opens into its chain: what the agent read, what it did, the decision, the rule.

Agents: add or remove Stroq's hooks, with the exact file change shown first. When Stroq was last asked, and which of an agent's settings weaken it.
Skills & MCP: every skill and MCP server by agent: where it came from, what the rules…