@stroq/cli 0.5.1 → 0.11.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +32 -12
- package/dist/asi.json +19 -0
- package/dist/atlas.json +993 -0
- package/dist/corpus.json +777 -0
- package/dist/index.js +4306 -962
- package/dist/scope.json +426 -0
- package/openclaw-plugin/README.md +49 -0
- package/openclaw-plugin/index.js +146 -0
- package/openclaw-plugin/openclaw.plugin.json +27 -0
- package/openclaw-plugin/package.json +17 -0
- package/openclaw-plugin/run-stroq.js +166 -0
- package/package.json +8 -7
- package/dist/index.js.map +0 -1
package/README.md
CHANGED
|
@@ -11,30 +11,50 @@
|
|
|
11
11
|
|
|
12
12
|
**Local action firewall for AI coding agents.** Stroq scans what your agent reads (files, web pages, MCP tool results, command output) for indirect prompt injection, taints the session when it finds instruction-like text, and deterministically blocks the dangerous follow-up actions an injected agent would take — outbound network commands, secret access, external git pushes, encoded execution, self-tampering. Everything runs locally; nothing is sent to a cloud.
|
|
13
13
|
|
|
14
|
-
Supported today: **Claude Code** (
|
|
14
|
+
Supported today: **Claude Code**, **Cursor**, **Codex**, **Copilot CLI**, **Windsurf** (native hooks) · **OpenClaw** (in-process plugin) · **any MCP client** (stdio proxy).
|
|
15
15
|
|
|
16
16
|
## Install
|
|
17
17
|
|
|
18
18
|
```bash
|
|
19
|
-
npx @stroq/cli init
|
|
20
|
-
npx @stroq/cli
|
|
19
|
+
npx @stroq/cli init # Claude Code: writes .claude/settings.json hooks
|
|
20
|
+
npx @stroq/cli init --agent cursor # Cursor: writes .cursor/hooks.json
|
|
21
|
+
npx @stroq/cli init --agent codex # Codex CLI: writes .codex/hooks.json
|
|
22
|
+
npx @stroq/cli init --agent copilot # Copilot CLI: writes .github/hooks/stroq.json
|
|
23
|
+
npx @stroq/cli init --agent openclaw # OpenClaw: installs a plugin into ~/.stroq/openclaw-plugin
|
|
24
|
+
npx @stroq/cli init --agent windsurf # Windsurf: merges into .windsurf/hooks.json
|
|
25
|
+
npx @stroq/cli init --agent mcp --client claude-desktop # any MCP client: wraps its stdio servers
|
|
26
|
+
npx @stroq/cli doctor # check the installation
|
|
21
27
|
```
|
|
22
28
|
|
|
23
29
|
`init` writes hooks into the project's `.claude/settings.json` by default; pass `--user` to install into `~/.claude/settings.json` instead, or `--dry-run` to preview the change.
|
|
24
30
|
|
|
25
31
|
Prefer a persistent install? `npm install -g @stroq/cli` installs the `stroq` command globally — then run `stroq init` and `stroq doctor` directly.
|
|
26
32
|
|
|
33
|
+
Windsurf note: `post_read_code` cannot scan a directory Cascade reads recursively (it scans the file it names, and a directory reads as empty), and a tainted `pre_read_code` of `~/.ssh` or `~/.aws` without a trailing slash is not classified as a secret path either — see the [Windsurf section of the full README](https://github.com/AGGIB/Stroq#windsurf) for this and every other documented limit.
|
|
34
|
+
|
|
35
|
+
MCP proxy note: for clients with no hook API, `--agent mcp` rewrites the client's `mcpServers` entries so each stdio server starts through `stroq mcp`, which judges every `tools/call` and scans every result. There is no way to prompt from inside a proxy, so a policy `ask` arrives as a blocked tool result naming the rule; HTTP (`url`/`serverUrl`) servers are skipped; and the project directory is the one `init` ran in — see the [MCP proxy section of the full README](https://github.com/AGGIB/Stroq#mcp-proxy-any-mcp-client) for this and every other documented limit.
|
|
36
|
+
|
|
27
37
|
## Commands
|
|
28
38
|
|
|
29
|
-
| Command
|
|
30
|
-
|
|
|
31
|
-
| `stroq init [--user] [--dry-run]`
|
|
32
|
-
| `stroq hook
|
|
33
|
-
| `stroq
|
|
34
|
-
| `stroq
|
|
35
|
-
| `stroq
|
|
36
|
-
| `stroq
|
|
37
|
-
| `stroq
|
|
39
|
+
| Command | What it does |
|
|
40
|
+
| ------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
41
|
+
| `stroq init [--agent <name>] [--user] [--dry-run]` | Install hooks for `claude-code`, `cursor`, `codex`, `copilot`, `openclaw` or `windsurf`, or wrap an MCP client's stdio servers with `--agent mcp --client <name>` or `--config <path>` (`--user` for the home-directory copy) |
|
|
42
|
+
| `stroq hook <agent>` | Hook entrypoint (reads the event on stdin; `copilot` and `openclaw` take a `pre`/`post` argument, the others do not) |
|
|
43
|
+
| `stroq mcp --server <name> -- <cmd>` | MCP stdio proxy: judges every `tools/call` and scans every result for one wrapped server |
|
|
44
|
+
| `stroq doctor` | Check Node version, rules, hooks for every agent, self-test |
|
|
45
|
+
| `stroq log [--count 20]` | Show recent audit entries |
|
|
46
|
+
| `stroq verify` | Verify the audit hash chain |
|
|
47
|
+
| `stroq untaint [--session <id>] [--all]` | Clear a false-positive session's taint and provenance, or every session's |
|
|
48
|
+
| `stroq why [--seq <n>]` | Explain the most recent denied/asked action: rule, provenance, taint |
|
|
49
|
+
| `stroq canary [--name <NAME>]` | Print a canary secret to plant; its outbound use is denied and taints the session |
|
|
50
|
+
| `stroq attack [--json] [--only <id>] [--fuzz]` | Replay 20 recorded incidents against your policy; `--fuzz` crosses every scenario with a deterministic mutation set and reports the variants that still reach `allow`; exit 1 if any gets through |
|
|
51
|
+
| `stroq exposure [--probe] [--share] [--json]` | Map this machine's agent surface and report what reaches you; exit 1 on any finding |
|
|
52
|
+
| `stroq bench [--corpus <dir>] [--json] [--verbose]` | Measure the shipped rule set's false-positive rate against a corpus of benign developer documentation; `--verbose` lists the flagged files |
|
|
53
|
+
| `stroq coverage [--format <table\|navigator>] [--json]` | Print the control mapping against MITRE ATLAS and OWASP ASI, built from the attack corpus's own scenario tags; `--format=navigator` emits an ATT&CK Navigator layer |
|
|
54
|
+
|
|
55
|
+
`stroq exposure` reads files only. `--probe` is the one flag that starts a process: it launches each configured stdio MCP server, asks once for `tools/list`, scans the tool descriptions and shuts the server down — no tool is ever called. Without it, tool-description poisoning is not covered by the run, and the report says so. `--share` prints a redacted summary built from a whitelist, locally; nothing is transmitted.
|
|
56
|
+
|
|
57
|
+
The corpus `stroq bench` measures against ships with this repository, not with the npm package; on an installed CLI, point it at your own documentation with `stroq bench --corpus <dir>` — the published number in [`docs/BENCH.md`](https://github.com/AGGIB/Stroq/blob/main/docs/BENCH.md) is exactly that command run against the vendored corpus.
|
|
38
58
|
|
|
39
59
|
## Learn more
|
|
40
60
|
|
package/dist/asi.json
ADDED
|
@@ -0,0 +1,19 @@
|
|
|
1
|
+
{
|
|
2
|
+
"source": "OWASP GenAI Security Project — OWASP Top 10 for Agentic Applications for 2026",
|
|
3
|
+
"edition": "2026",
|
|
4
|
+
"published": "2025-12-09",
|
|
5
|
+
"url": "https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/",
|
|
6
|
+
"note": "Unlike MITRE ATLAS, OWASP publishes this list as a PDF only — the OWASP Agentic Security Initiative has no machine-readable release. The ten ids and names below are transcribed by hand from that document, which is why this layer is secondary and version-pinned rather than vendored and hashed like atlas.json. This is a different taxonomy from the earlier OWASP 'Agentic AI Threats and Mitigations' (v1.0, February 2025), which numbers its threats T1 through T15; the ASI-prefixed ids here belong only to the 2026 Top 10 for Agentic Applications. Two per-scenario tags in corpus.json depart from their cohort deliberately: `07-settings-hook-removal` and `14-agents-md-invisible-hook-disable` carry no ASI06 because both steps empty or disable the hooks block of `.claude/settings.json` — subtracting a control, not poisoning context with persistent misleading content, unlike `19-dependency-postinstall-persistence`'s planted `UserPromptSubmit` hook, which is the textbook case; and `02-sentry-agentjacking` carries ASI05 like every other `effect: \"exec\"` scenario because its `ask` rather than `deny` expectation reflects Stroq's confidence in blocking, not whether the scenario demonstrates unexpected code execution.",
|
|
7
|
+
"risks": [
|
|
8
|
+
{ "id": "ASI01", "name": "Agent Goal Hijack" },
|
|
9
|
+
{ "id": "ASI02", "name": "Tool Misuse" },
|
|
10
|
+
{ "id": "ASI03", "name": "Identity & Privilege Abuse" },
|
|
11
|
+
{ "id": "ASI04", "name": "Agentic Supply Chain Compromise" },
|
|
12
|
+
{ "id": "ASI05", "name": "Unexpected Code Execution" },
|
|
13
|
+
{ "id": "ASI06", "name": "Memory & Context Poisoning" },
|
|
14
|
+
{ "id": "ASI07", "name": "Insecure Inter-Agent Communication" },
|
|
15
|
+
{ "id": "ASI08", "name": "Cascading Agent Failures" },
|
|
16
|
+
{ "id": "ASI09", "name": "Human-Agent Trust Exploitation" },
|
|
17
|
+
{ "id": "ASI10", "name": "Rogue Agents" }
|
|
18
|
+
]
|
|
19
|
+
}
|