GitHub radar
See who's really in charge of your AI coding agent
Stroq shows how many commands your agent ran from text it read, and which keys may have left your machine — free and offline.
It's a local security tool that reads your Claude Code or Codex session history and surfaces hidden risks.
When it helps
Useful if you work with an AI coding agent in the terminal daily and let it read files or websites. Skip it if your agent never touches outside code.
Pros
- Runs fully offline, no data ever leaves your machine
- Shows which keys your agent's model has seen
- Turn on guard mode so the agent asks first
- Tested against 36 attacks, none slipped through unnoticed
Cons
- Can't trace a command the model writes entirely from scratch
- Requires Node.js version 22 or newer
How to set it up — step by step
- 1Open a terminal in your project folder.
- 2Run npx @stroq/cli — no install needed.
- 3Check the card for how many commands came from text and which keys were spotted.
- 4Send the agent the text from the block below if you'd rather have it do this for you.
- 5For ongoing protection, run npx @stroq/cli init so the agent asks before risky actions.
Text for your agent
Copy this and send it to your agent — Claude Code, Codex, any of them:
Install Stroq from https://github.com/AGGIB/Stroq — run npx @stroq/cli right in the current project folder and show me the resulting card: how many commands came from text the agent read, and which keys it saw.
Runs on a regular laptop — just Node.js 22 or newer, no GPU needed.
Open on GitHub▌ More finds