Pipelock v3.2.0: Open-Source AI Agent Firewall Released

What changed

Pipelock, an open-source firewall designed for AI agents, has seen its latest release, version 3.2.0. This tool acts as a security layer positioned between AI agents and the network, meticulously inspecting mediated HTTP, WebSocket, MCP, and A2A traffic. When TLS interception is enabled, it also scrutinizes CONNECT tunnel contents. The primary focus of this inspection is to detect and prevent various security threats, including secret exfiltration, prompt injection, Server-Side Request Forgery (SSRF), tool poisoning, and risky tool-call chains. For plain CONNECT requests without interception, Pipelock scans at the hostname and URL level. A specific exception is made for configured MCP upstreams, allowing local or private servers while still blocking cloud metadata endpoints to prevent SSRF attacks.

A key feature of Pipelock is its generation of mediator-signed action receipts. These receipts provide verifiable audit evidence of the boundary decisions made by Pipelock, independent of the agent's runtime environment. This allows reviewers to confirm Pipelock's actions outside the agent. The project also maintains the agent-egress-bench corpus, which is used to test Pipelock's detection capabilities against real-world attack scenarios. The Gauntlet workflow is a scheduled examination of Pipelock against a pinned corpus commit, though it does not automatically publish public scores.

Supported Integrations

Pipelock is designed to work with a wide array of AI development tools and platforms, including:

• Models & Code: Claude Code, OpenAI Codex, OpenCode, Pi, Zed, Cursor, VS Code, JetBrains
• SDKs & Frameworks: OpenAI Agents SDK, Google ADK, AutoGen, CrewAI, LangGraph

Installation and Verification

Users can build Pipelock from source (requiring Go 1.26+) by cloning the repository and running make install. Alternatively, pre-built binaries are available via GitHub releases, and Docker images can be pulled from ghcr.io/luckypipewrench/pipelock:3.5.0. For macOS users, installation via Homebrew is also supported (brew install luckyPipewrench/tap/pipelock). Release integrity can be verified using gh attestation verify for binaries and OCI images, ensuring authenticity and provenance.

Why it matters for builders

For AI builders, Pipelock addresses a critical security gap in deploying AI agents. As agents gain more capabilities and access to external resources, the risk of sensitive data leakage or malicious exploitation increases. Pipelock provides a robust mechanism to monitor and control agent network egress, offering peace of mind and a more secure operational environment. The verifiable audit trail generated by signed action receipts is invaluable for compliance and debugging, allowing developers to confidently demonstrate the security posture of their AI systems.

Practical impact

AI developers can integrate Pipelock into their agent deployment pipelines to enhance security. The tool offers different operational modes: strict for high-security environments, balanced (the default) for most development scenarios, and audit for evaluation. Builders can leverage the pipelock demo command to quickly test its capabilities and verify receipt signatures locally. For ongoing operations, pipelock run can record agent activity, and pipelock evidence view or pipelock evidence serve can generate offline reports or serve them read-only. The project also provides a live playground for immediate testing without local setup.

Caveats and source limits

The source material indicates that pre-built release artifacts include paid-tier code that requires a license key for activation, distinguishing them from the community edition built from source. While Pipelock emits signed receipts, the operator running Pipelock holds the signing key, meaning the receipt proves what the boundary decided and that the key holder signed it, not necessarily the operator's inherent honesty. End-to-end verification against an operator-independent anchor (like Rekor transparency logs) is still under development. The agent-egress-bench corpus is available for users to run themselves to verify performance claims. The latest release mentioned in the excerpt is v3.2.0, but installation instructions refer to v3.5.0 and v3.6.0 for Helm charts, indicating potential version discrepancies or ongoing updates.