OpenViSTAI · Agents · Blockchain · Crypto
Submit a project
Menu
Agent Security & Sandboxing

Pipelock

Pipelock is a self-hosted Go network intermediary and firewall for AI agents. It inspects routed HTTP, WebSocket, MCP and A2A traffic for secret exfiltration, SSRF, prompt injection, tool poisoning and risky tool-call chains, and emits mediator-signed action receipts for its boundary decisions.

Explore the practical guide ↓

Independent OpenViST project profile, based on linked sources.

Pipelock — OpenViST project profile in Agent Security & Sandboxing.
OpenViST project illustration. See the linked sources for product details.
Understand the project

Practical overview

When it fits

Use it when an agent’s outbound or tool traffic can be routed through a proxy, MCP wrapper, sandbox, host-containment model or cluster topology and you want security inspection at that boundary.

Who it is for

  • Developers integrating agent tools or frameworks who need mediated network and tool traffic inspected.
  • Teams seeking egress controls and signed evidence of security decisions made outside an agent runtime.

Documented uses

  • Route agent traffic through an intermediary that can block or flag detected risks.
  • Inspect MCP and A2A tool traffic for prompt injection, tool poisoning and risky call chains.
  • Create mediator-signed receipts that reviewers can verify outside the agent runtime.
  • Generate a starting configuration from local agent integrations or a documented preset.
Before you choose

Requirements & limits

The core is open source under Apache-2.0. The documented source-build path requires Go 1.26 or later and produces a Community-only binary.

  • Inspection applies to mediated traffic; agents must be routed through a documented boundary integration.
  • CONNECT traffic is inspected at hostname and URL level without TLS interception; tunnel contents can be inspected when TLS interception is enabled.
  • Configured MCP upstreams may use private addresses, but cloud metadata endpoints remain blocked.
  • Balanced mode is documented as warning by default and strict mode as blocking.
  • Signed receipts provide evidence of Pipelock’s boundary decisions, not actions outside the mediator.

Check current requirements in the official documentation. Source-based guidance does not mean OpenViST has run or independently tested this project.

Source-based practical guide

Build Pipelock from source and generate a starter configuration

Build the Community edition from source, then generate a configuration file for local agent integrations.

Before you start

  • Go 1.26 or later.
  • A shell environment with Git and Make.
  • The repository’s v3.7.0 source tag, as specified in the README Quick Start.

Steps

  1. Clone the repository at the v3.7.0 tag with the documented shallow-clone command.

  2. Run the command below to build and install the Community edition.

    Documented command
    make -C pipelock install

  3. Run pipelock init --output ./pipelock.yaml to discover local agent integrations and save a configuration.

Expected outcome

A Community-edition installation and a generated `pipelock.yaml` configuration file.

Guide limitations

  • This documents installation and configuration generation, not routing an agent through Pipelock or deploying a running gateway.
  • The Quick Start identifies v3.7.0 examples as applying once release artifacts are published.
Documentation 1 ↗
Evidence and transparency

Sources & review

Official repository ↗
Source record details
Source availability
Active
Sources checked
13 October 2026
Original website title
luckyPipewrench/pipelock · Official homepage title · retained in its source language
How we review sourcesSuggest a correction