Pipelock

What it is

Pipelock v3.5.0 (Community edition, Go 1.25+), an open-source AI agent egress firewall. The summary covers its scanning scope; this page adds the concrete verification model, the build/licensing split, and several self-stated honesty caveats an evaluator needs before trusting its receipts.

How it works

Pipelock mediates outbound/inbound traffic and emits mediator-signed action receipts over boundary decisions, verifiable offline with a key you hold — no account, no server. It writes a "flight-recorder" session while running (distinct from the demo receipts). Detections are exercised against the public agent-egress-bench corpus; the "Gauntlet" workflow is a scheduled exam against a pinned corpus commit and does not auto-publish a public score.

Preconditions / Affected

• TLS interception must be enabled to inspect CONNECT tunnel contents. Plain CONNECT without interception is scanned only at hostname/URL level — a real coverage gap.
• Source builds (make build/make install) produce a Community-only binary. Pre-built release artifacts contain paid-tier code that activates with a license key. The Pro/Enterprise dashboard, RBAC, and fleet views exist only in enterprise-tagged builds.

What to do

Zero-config demo that writes signed receipts and the public key, then verify a signature yourself:

pipelock demo --receipts-dir ./out
pipelock verify-receipt "$(ls ./out/*.json | head -1)" --key ./out/signer.pub

Record a live session and produce an offline report:

pipelock init --output ./pipelock.yaml
pipelock run --config ./pipelock.yaml
pipelock evidence view --receipt-dir ./recorder --out report.html

Verify release artifact integrity (SLSA provenance, SBOMs, signed images published per release):

gh attestation verify pipelock_3.5.0_linux_amd64.tar.gz --owner luckyPipewrench
gh attestation verify oci://ghcr.io/luckypipewrench/pipelock:3.5.0 --owner luckyPipewrench

Free pipelock report, Prometheus, and Grafana paths monitor a single instance; cross-agent fleet control (Conductor) is Enterprise-only.

Caveats

The page states these limits itself:

• The demo signs with an ephemeral key it prints per run — receipts are self-consistent, not tied to a named identity. The public playground verifies against a key Pipelock publishes.
• The operator holds the signing key. A receipt proves what the boundary decided and that the key holder signed it — not that the operator is honest.
• pipelock anchor receipts writes receipt-chain checkpoints to a local backend or Rekor, but operator-independent verification against that anchor is "still being proven end to end."
• Receipts prove nothing about activity outside the boundary Pipelock mediates.