Stroq: open-source hooks that check what coding agents run and send

On 5 November 2026 a developer posting as agybay_07 introduced Stroq on Hacker News as "a local audit of what your coding agent did and why". The project, at github.com/AGGIB/Stroq, is licensed Apache-2.0 and needs Node.js 22 or newer. Its README says it reads your own Claude Code and Codex sessions and shows how many commands came from text the agent read, and which keys left your machine.

What it does, per the README

• Check: `npx @stroq/cli` reads 30 days of sessions plus key files, prints key names never values, and writes only a small cache under `~/.stroq`.
• Replay: `stroq replay` runs past sessions against today's policy, so it works on sessions from before Stroq was installed. The README notes the verdicts are today's policy's, not a record of what happened at the time.
• Sent: `stroq sent` sorts each key into sent to another company, maybe sent, seen by the AI, used with its own service or blocked before it ran.
• Guard: `stroq init` installs hooks for Claude Code, Cursor, Codex CLI, Copilot CLI, Windsurf and Antigravity that judge each tool call before it runs, using rules rather than a model, as the author confirmed in the thread.

What the author reports and what it leaves out

The README says `stroq attack` replays 36 attacks from public reports and synthetic cases in a throwaway home. On version 0.30.0 it reports 15 denied, 21 asked about and 0 passed through. The attack set and the score both come from the project itself; no independent test is cited, and the README does not give a false-positive rate in the sections I read.

The README states its limits plainly: a hook sees only what the host agent sends it, matching is text-level, and a command the model writes from scratch does not trace back to a source. A key that leaves in a script, file or variable may not show in the command.

The pushback

The strongest objection, from commenter embedding-shape, was that an audit arrives too late and the real fix is to run the agent as its own user with limited paths and network. The author replied "You're right", saying `stroq init` hooks prompt before a dangerous command but are "a filter, not a sandbox". Another commenter, arnarbi, argued auditing is how teams discover gaps in access policy. A third, philips, said they run agents in gVisor isolation with a default-deny egress proxy and would not rely on a harness tool boundary.

A commenter also described two fake recruiter repositories, one with an `eval()` hidden in a function named `getCookie()`; the author said the hook would catch only the `npm test` command itself there, and that `stroq inspect` would flag the hook before the folder is opened. That is the author's description, not a demonstrated result.

What to do with it

The read-only check is the low-risk part: run it on a developer laptop and see whether any key shows as sent to another company, then rotate those. Treat the live hooks as an extra prompt, not a boundary, and keep sandboxing and outbound network limits for any agent with real credentials.