Stroq Audits Claude Code and Cursor Sessions, and Calls Itself No Sandbox

Stroq, an Apache-2.0 command-line tool that audits what Claude Code, Cursor and Codex CLI did on a developer's machine, reached 171 GitHub stars after a Show HN post, and its README says plainly that it is "a filter, not a sandbox."

The project is published by the GitHub user AGGIB, with no individual maintainers named. It installs with npx @stroq/cli and needs Node.js 22 or newer. The repository showed 837 commits and version 0.30.0 in its console output, but an empty Releases section.

What Stroq does

Two things, per the README. The first is retrospective. stroq sent reads local session records from Claude Code, Codex CLI and Cursor, compares them with credentials found on the machine, and reports where each key went. The README's sample output reads "6 of your 6 keys appear in your agent sessions: 2 sent to another company, 1 maybe sent, 1 seen by the AI, 1 used with its own service, 1 blocked before it ran." It prints names and sources, never values.

The second is preventive. Hooks judge each tool call before it runs. They deny curl | sh and outbound calls carrying a known secret, and ask the user first when a command repeats text the agent read. A staged example in the README traces a command back to a GitHub issue the agent had read, and denies it 18 seconds later.

The README says Stroq "sends nothing" and has "No account, no telemetry." It writes only a small cache under ~/.stroq.

The hook is only as strong as the host

Stroq's preventive layer rides on the hook systems of each agent. Anthropic's Claude Code documentation describes the PreToolUse hook as running "before a tool call executes" and able to block it, by returning a permissionDecision of deny or by exiting with code 2.

The same documentation sets limits. "On PreToolUse, a timed-out command, http, or mcp_tool hook doesn't block the tool call, except for hooks whose failure blocks the action." A hook can opt into blocking on failure with "onFailure": "block". And silence is not approval: exit code 0 with no output sends the call back through the normal permission flow.

Hook outcome in Claude Code	Effect on the tool call
Exit code 2	Blocked, stderr is the reason
permissionDecision of deny	Blocked
Timeout, default setting	Call proceeds
Exit 0, no output	Normal permission flow

The README text fetched for this report does not say what Stroq does when its own hook times out, and which setting its installer writes is not given there. That is the question a reader should answer before treating it as a gate.

The README's own limits

The README lists them itself. Hooks see only what each host sends, which varies by agent and version. Matching is text-level, so a command the model writes from scratch will not trace back to a source. A key that never appears in a command can still leave in a script, file or variable. Old, rotated or unknown secrets may be missed, and a local transcript match "doesn't by itself prove delivery" to a provider.

Windows users cannot add hooks from the console and run stroq init instead.

Related coverage: Claude Code sending an email address to websites and Vercel's agent desktop tooling.

With the Releases section empty, the first tagged release is the first point a reader can pin an audit to.