Stroq audits what coding agents did and why, locally

Stroq is an open source, local tool from AGGIB for auditing AI coding agent sessions, including Claude Code and Codex. Its npx @stroq/cli command reads the last 30 days of sessions, key files and the folders the agent worked in, then prints key names but never values. The project says it writes only a small cache under ~/.stroq, sends nothing, and needs no account or telemetry.

Beyond the audit card, the project describes hooks that judge each tool call before it runs. According to the README, they deny curl | sh and outbound calls that carry a known secret, and they ask first when a command repeats text the agent read. The project lists support for Claude Code, Cursor, Codex CLI and others.

The stroq attack command runs 36 attacks against a policy in a throwaway home. On version 0.30.0, the project reports 15 denied, 21 asked about and none passing through. The docs also state limits: Stroq is a filter rather than a sandbox, matching is text-level, and a key that did not appear in a command may still have left in a script. It requires Node.js 22 or newer.

Developers running Claude Code or Codex can check past sessions for known keys that appeared in outbound commands before deciding what to rotate. A live hook can block some exfiltration patterns, but it only sees what each agent host sends it, so the documented limits matter before relying on it. Treat it as a filter, not a sandbox.