Show HN: Stroq – block commands injected through MCP tool output (stroq.dev)

Stroq, an open-source security tool aimed at safeguarding AI code generation agents, has been launched to combat agentjacking attacks, where malicious code can exploit vulnerabilities through injected commands. In a recent incident, attackers were able to execute malicious npx packages across 2,388 organizations using fake Sentry errors, leading to significant security breaches. Stroq mitigates this risk by monitoring the commands that agents read and executing a two-phase scanning process that taints suspicious sessions and blocks harmful actions before they leave the machine—eliminating dependency on cloud models or external networks. The tool integrates with multiple popular coding environments, functioning as a native hook for agents like Claude Code, Cursor, and Copilot CLI, while also providing a stdio proxy for other clients. It employs a comprehensive rule system to evaluate outgoing actions based on their context, marking any suspicious triggers without relying solely on the agent's ability to recognize threats. This proactive approach to security is significant for the AI/ML community as it addresses the critical vulnerabilities inherent in AI tools, bolstering overall code safety while remaining open-source under the Apache-2.0 license, ensuring accessibility and transparency for developers.