github.com/luckyPipewrench/pipelock

Added

• TLS interception for CONNECT tunnels: opt-in MITM decrypts tunnel traffic for full request body DLP, header DLP, and response injection scanning. ECDSA P-256 CA with bounded TTL certificate cache.
• pipelock tls init command: generates a local CA key pair for TLS interception
• pipelock tls show-ca command: displays the CA certificate (PEM) for manual trust
• pipelock tls install-ca command: installs the CA into the system trust store
• tls_interception config section with enabled, ca_cert, ca_key, cert_ttl, and passthrough_domains fields. Hot-reload wiring for CA config changes.
• TLS interception SSRF-safe upstream dialer prevents DNS rebinding during intercepted connections
• TLS interception status reported in /health endpoint
• pipelock_tls_intercept_total, pipelock_tls_handshake_duration_seconds, pipelock_tls_request_blocked_total, pipelock_tls_response_blocked_total, pipelock_tls_cert_cache_size Prometheus metrics
• tls_authority_mismatch, tls_response_blocked audit events with MITRE technique labels
• All 7 config presets updated with tls_interception section defaults
• pipelock report command: reads JSONL audit logs and produces HTML, JSON, or Ed25519-signed evidence bundle reports with risk rating, event categories, timeline histogram, and evidence appendix. Supports --format, --output, --sign, and --config flags.
• MCP tool poisoning: parameter schema scanning extracts parameter key names from inputSchema at all nesting depths, expands underscore/hyphen/camelCase names, and scans for exfiltration intent (catches the CyberArk attack variant where data theft is encoded in parameter names while descriptions stay clean)
• Exfiltration Parameter Name poison pattern: detects action+target combinations in tool parameter names (read+private_key, steal+credentials, fetch+access_token)
• MCP tool drift summaries now report which parameters were added or removed instead of generic "description changed" messages
• Audit schema: chain detection structured events, startup/reload config hash metadata, version tracking
• Config.Hash() for deterministic SHA256 of raw config file bytes (used in signed reports)
• Dependency review GitHub Actions workflow: blocks PRs that introduce dependencies with known vulnerabilities
• CI concurrency groups: in-progress runs cancelled when new commits push to the same branch
• SPDX Apache 2.0 license headers on all Go source files
• GitHub Sponsors funding configuration
• Contributor License Agreement (Apache ICLA) section in CONTRIBUTING.md
• SPONSORS.md for sponsor recognition

Fixed

• Environment variable leak scanner: ~50 well-known non-secret variables (HOME, PATH, USER, PWD, SHELL, TERM, LANG, EDITOR, GOPATH, LS_COLORS, and others) are now skipped by name, reducing false positives when agents send standard environment values in tool arguments. Case-insensitive matching handles Windows-style mixed-case names.
• TLS interception: ActionAsk treated as block inside intercepted tunnels (no HITL terminal available in TLS context)
• TLS interception: LoadCA validates cert.IsCA, KeyUsageCertSign, and key correspondence. Rejects cert_ttl <= 0 and group/world-readable CA keys.
• MCP: skip general injection scanner for tools/list responses when tool scanning is enabled, preventing false positives on instructional tool descriptions (e.g. "you must call this tool")
• Report: chain detection severity derived from action (block=critical, warn=warn) instead of storing caller-provided value
• Report: hash raw client IP in audit session field when Mcp-Session-Id absent, preventing IP leak
• Report: plain blocked events without an action field now get high severity instead of medium
• Report: evidence appendix redacts connect_host and sni_host IP addresses
• Report: admin events (startup, shutdown, config_reload) excluded from timeline histogram
• Report: skipped JSONL lines tracked and surfaced in summary and HTML template
• Report: criticals KPI counter uses severity:critical count (was always 0)
• Report: exec summary uses traffic-only event count as denominator (excludes admin events)
• Report: multi-day timeline labels use "Jan 2" date format instead of "00:00" for all bars

Changed

• Documentation version references use v1/latest instead of pinned version numbers so guides stay current across releases

Added

• Kill switch API token can now be set via PIPELOCK_KILLSWITCH_API_TOKEN environment variable, overriding the kill_switch.api_token config field. Enables Kubernetes deployments to source the token from a Secret instead of a ConfigMap.
• Request body DLP scanning for the forward HTTP proxy. Scans POST/PUT/PATCH bodies for secrets across JSON (recursive string extraction), form-urlencoded, multipart/form-data, and raw text. Unknown content types get a fallback raw-text scan to prevent Content-Type spoofing bypass. Fail-closed on oversized bodies, compressed bodies, parse errors, and multipart limit violations.
• Request header DLP scanning for the forward proxy and fetch handler. Two modes: sensitive (scan listed headers only) and all (scan everything except structural headers, including header names). Joined scan catches secrets split across multiple headers.
• request_body_scanning config section with enabled, action, max_body_bytes, scan_headers, header_mode, sensitive_headers, and ignore_headers fields
• pipelock_body_dlp_hits_total and pipelock_header_dlp_hits_total Prometheus counters
• body_dlp and header_dlp audit event types
• Shared JSON string extractor (internal/extract) used by both proxy body scanning and MCP input scanning
• hostile-model config preset for agents running uncensored or jailbroken models
• Windows build support: GoReleaser produces Windows amd64/arm64 binaries (zip archives). Kill switch signal toggle and config reload signal are no-ops on Windows; all other features work identically.
• CONNECT tunnel SNI verification: detects domain fronting (T1090.004) by comparing the CONNECT target hostname against the TLS SNI extension. Enabled via forward_proxy.sni_verification: true. pipelock_sni_total Prometheus counter tracks matches.
• pipelock claude hook/setup/remove commands for Claude Code hook integration
• MCP confused deputy protection: validates that MCP server response IDs match previously tracked request IDs. Blocks unsolicited responses that could hijack agent execution flow.
• IPv4 and IPv6 multicast CIDRs (224.0.0.0/4, ff00::/8) added to default SSRF internal address list

Fixed

• IPv6 zone ID SSRF bypass: URLs like http://[::1%25eth0]/ no longer skip CIDR checks. Zone IDs are stripped before IP parsing.

Fixed

• pipelock cursor install now writes Cursor's v1 hooks.json format (map keyed by event name with version field). Previously wrote a flat array that Cursor silently ignored, causing hooks to never fire.
• pipelock cursor install now preserves args fields on existing hooks during merge. Previously, non-pipelock hooks with args arrays lost their arguments after install or upgrade.
• pipelock preflight now scans both v1 and legacy hooks.json formats. Previously only understood the legacy format and would false-positive on v1 files.

Added

• pipelock verify-install command: 10 deterministic checks verifying scanning pipeline and network containment. Produces human-readable or --json output with optional Ed25519 --sign for tamper-evident reports. Supports --output to write results to file.
• pipelock cursor hook subcommand: Cursor IDE hook integration. Reads hook events from stdin, evaluates DLP, injection, and tool policy, writes allow/deny JSON to stdout. Always exits 0 with JSON permission field as the authoritative decision. Without --config, uses a security-focused default profile with 9 tool policy rules, MCP input scanning, and response scanning enabled.
• pipelock cursor install subcommand: writes hooks.json to register pipelock with Cursor. Supports --global (default, ~/.cursor/) and --project (.cursor/ in cwd). Atomic writes via temp file + rename, .bak backup, idempotent merge with existing hooks, upgrade-safe replacement of stale entries.
• internal/decide package: shared decision engine for evaluating agent actions against pipelock's scanning pipeline. Supports shell execution, MCP tool calls, and file read events with per-finding action semantics (block vs warn) and enforce flag override.
• Fail-closed on malformed MCP tool_input: invalid JSON in tool arguments is treated as block-level evidence. Legitimate MCP tool calls always have valid JSON; parse failure indicates tampering or corruption.
• pipelock audit --preflight scanner: detects dangerous IDE configuration files (.cursor/mcp.json, .vscode/mcp.json) in project directories that could override agent security settings. Reports threat level (critical/high/medium/low) with actionable remediation steps.

Changed

• Replaced all //nolint:gosec G304 suppressions with filepath.Clean() across production and test code (84 occurrences in 26 files). No behavioral change.
• Eliminated all //nolint:goconst directives, extracted named constants

Fixed

• Pre-existing lint issues in tests/ws-helper/main.go: errcheck on conn.Close(), noctx on net.Listen

Added

• pipelock diagnose command: fully local end-to-end configuration verification. Spins up a mock upstream and temp proxy, runs 6 checks (health, fetch allowed/blocked, hint presence, CONNECT allowed/blocked). Exit 0 on pass, 1 on failure, 2 on config error. Supports --json and --config.
• explain_blocks config field (opt-in, default false): blocked responses include actionable hints explaining why a request was blocked and how to fix it. Fetch proxy gets a JSON hint field, CONNECT and WebSocket get an X-Pipelock-Hint header. Hints are per-scanner (DLP, blocklist, SSRF, entropy, rate limit, etc.).
• Scanner label constants (scanner.ScannerDLP, scanner.ScannerBlocklist, etc.): 12 exported constants matching existing on-wire metric label values
• proxy.Handler() method: returns the composed HTTP handler for use with httptest.NewServer or custom listeners
• Docker Compose quickstart (examples/quickstart/): production-ready two-network architecture with internal: true isolation, opt-in verification suite (5 tests: network isolation, DLP, response injection, MCP tool poisoning), attacker container for reproducible demos

Fixed

• generate mcporter now preserves per-server extra fields (alwaysAllow, disabled, metadata, headers, etc.) during wrapping. Previously only command, args, and env survived.
• WebSocket scanner label split: protocol enforcement events now correctly use ws_protocol label
• Grafana dashboard template variable syntax corrected for fleet filtering

Changed

• Reusable scan workflow actions pinned to commit SHAs for OpenSSF Scorecard compliance

Added

• WebSocket MCP transport: --upstream ws:// and wss:// for MCP proxy connections, with the same 6-layer scanning pipeline as stdio and HTTP modes
• pipelock generate mcporter CLI: wraps MCP server configs with pipelock scanning. Reads any JSON with mcpServers, preserves env blocks, detects already-wrapped servers, idempotent
• pipelock-init container image: Alpine-based multi-arch image for K8s initContainer deployments, replaces multi-line wget/tar/chmod scripts with cp /pipelock /shared-bin/pipelock
• MITRE ATT&CK technique IDs mapped to all scanner labels (T1048, T1059, T1046, T1071.001, T1190, T1195.002, T1078, T1030) in blocked, anomaly, ws_scan, response_scan, session_anomaly, and mcp_unknown_tool audit events and emitted payloads
• pipelock_kill_switch_active{source} Prometheus gauge via custom collector (fresh state per scrape, four sources: config, api, signal, sentinel)
• pipelock_info{version} build information metric
• Metrics port isolation: metrics_listen config field runs /metrics and /stats on a dedicated port, preventing agents from scraping operational metadata. Changes rejected on hot-reload with a warning.
• Cosign signature verification in the GitHub Action: release checksums verified against Sigstore attestation before binary install. Graceful degradation when cosign is unavailable.
• Reusable GitHub Actions security scan workflow (.github/workflows/reusable-scan.yml) with 7 configurable inputs and score, findings-count, critical-count outputs
• 7 new docs: configuration reference, deployment recipes (Docker/K8s/iptables/macOS PF), bypass resistance matrix, attacks-blocked gallery, policy spec v0.1, transport modes guide, OpenClaw deployment guide
• Prometheus metrics reference (docs/metrics.md): all 20 metrics with scrape config and PodMonitor example
• 11 ready-to-use Prometheus alert rules (examples/prometheus/pipelock-alerts.yaml)
• Grafana dashboard rebuilt from 4-panel overview to 18-panel fleet monitor with per-source kill switch status, chain detection by pattern, session anomaly breakdown, escalation timeseries, and multi-instance $instance filter variable
• filterAndActOnResponseScan helper: extracted response scan action handling (suppress, block, ask, strip, warn) to eliminate duplication between raw HTML and extracted text scan paths
• Demo extended with base64-encoded secret detection, git diff scanning, and config generation steps

Fixed

• internal: [] in YAML config now correctly disables SSRF checks. Previously, ApplyDefaults() treated explicit empty slices the same as absent fields, filling in default CIDRs. This blocked legitimate Docker container traffic on private IPs (172.x.x.x).
• Reject WebSocket compressed frames (RSV1 bit): compressed bytes bypass DLP pattern matching entirely, now closed with StatusProtocolError on both relay directions
• Scan raw HTML body before go-readability extraction: injection hidden in HTML comments, script/style tags, and hidden elements was stripped before the response scanner could detect it
• Use Mozilla Public Suffix List for ccTLD-aware domain grouping: baseDomain() now correctly groups evil.co.uk instead of merging all .co.uk domains into one rate limit bucket
• Prompt injection detection regex broadened to catch determiner-before-modifier evasion variants (e.g. "ignore your previous instructions", "forget the prior rules")
• RFC 6455 compliance: WebSocket proxy now sends masked close frames to upstream connections (previously sent unmasked server-style frames)

Changed

• Telemetry label split: WebSocket protocol enforcement events (binary frame rejection, fragment errors) now emit scanner label ws_protocol instead of policy. The policy label is now exclusively for MCP tool policy violations. MITRE mapping: ws_protocol maps to T1071 (Application Layer Protocol), policy remains T1059 (Command and Scripting Interpreter). Update any dashboards or alert rules that filter on scanner="policy" for WebSocket-specific events.
• internal/wsutil package extracted: shared WebSocket utilities (fragment reassembly, close frames, error classification) used by both the HTTP WS proxy and MCP WS transport
• Anomaly audit events now include scanner as a structured field with MITRE technique mapping (previously embedded in reason string)
• README slimmed from 829 to ~490 lines; full configuration YAML replaced with link to docs/configuration.md, forward proxy quick start moved to collapsible section
• Quick start updated to use pipelock check (works without running the proxy)
• golang.org/x/net promoted from indirect to direct dependency (publicsuffix for ccTLD handling)

Added

• Kill switch: emergency deny-all with four activation sources (config, SIGUSR1 signal, sentinel file, HTTP API), OR-composed so any single source blocks all proxy traffic
• Kill switch API: POST /api/v1/killswitch (activate/deactivate) and GET /api/v1/killswitch/status (per-source state) with bearer token auth, rate limiting, and input hardening (MaxBytesReader, DisallowUnknownFields, strict EOF enforcement)
• Kill switch port isolation: api_listen config field runs the kill switch API on a dedicated port, preventing agents from deactivating their own kill switch in sidecar deployments
• Event emission: fire-and-forget dispatch to webhook and syslog sinks with independent severity filters (info, warn, critical), configurable instance_id, and async buffered delivery
• Webhook sink: HTTP POST with bearer token auth, configurable timeout and queue size, background worker with graceful shutdown
• Syslog sink: UDP/TCP delivery with configurable facility, tag, and severity mapping to syslog priority levels
• Finding suppression: silence known false positives via config (suppress entries with rule name, path glob, and reason) or inline // pipelock:ignore source comments
• Tool call chain detection: subsequence matching on MCP tool call sequences with 8 built-in attack patterns (recon, credential theft, data staging, exfiltration), configurable window size, time-based eviction, and max-gap constraint
• Session profiling and adaptive enforcement config sections (scoring-only in v1, observability groundwork)
• Health endpoint now reports kill_switch_active field
• Preset configs (strict, balanced) updated with kill switch and emit examples (commented out)
• DLP: 6 new patterns: Fireworks API Key, Google API Key, Google OAuth Client Secret (GOCSPX), Slack App Token (xapp-), JWT Token, Google OAuth Client ID
• DLP: expanded AWS Access ID detection from AKIA-only to all 9 credential prefixes (AKIA, ASIA, AROA, AIDA, AIPA, AGPA, ANPA, ANVA, A3T)
• DLP: expanded GitHub Token detection to cover all 5 token types (ghp, gho, ghu, ghs, ghr)
• All 6 preset configs (balanced, strict, audit, claude-code, cursor, generic-agent) updated with expanded DLP pattern set (22 patterns)
• DLP include_defaults config field: when true (default), user-defined DLP patterns are merged with built-in defaults by name, so new default patterns are automatically added on binary upgrade without requiring config changes. Set include_defaults: false to use only user-defined patterns (previous behavior). Same field available for response_scanning.
• Finding suppression guide (docs/guides/suppression.md): documents all three suppression layers (inline comments, config entries, --exclude flag), available rule names, path matching styles, and GitHub Action integration

Fixed

• Close WebSocket cross-message DLP bypass: secrets split across WebSocket text frames are now detected via fragment reassembly buffer scanning (PR #140)
• Close header rotation evasion: IP-level domain tracking prevents agents from rotating Host/Origin headers to bypass per-domain rate limits (PR #141)

Changed

• MCP package refactored into sub-packages: transport, tools, policy, jsonrpc for clearer separation of concerns
• Audit logger enhanced with event emission dispatch: audit calls now route to configured webhook/syslog sinks based on severity
• Normalize package extracted as internal/normalize with ForPolicy variant for MCP tool policy command matching

Added

• WebSocket proxy: /ws?url=ws://... endpoint with bidirectional frame relay, DLP + injection scanning on text frames, fragment reassembly, message size limits, SSRF-safe upstream dialer, auth header forwarding with DLP scanning, concurrency limits, connection lifetime and idle timeout controls, and Prometheus metrics
• WebSocket configuration: websocket_proxy section in config with max_message_bytes, scan_text_frames, allow_binary_frames, strip_compression, max_connection_seconds, idle_timeout_seconds, origin_policy, and max_concurrent_connections
• WebSocket health reporting: /health endpoint includes websocket_proxy_enabled field
• All 6 preset configs updated with websocket_proxy defaults (disabled by default)
• --exclude flag for pipelock audit and pipelock git scan-diff: filter findings by path using globs (*.generated.go) or directory prefixes (vendor/). Repeatable for multiple patterns.
• GitHub Action exclude-paths input: newline-separated path patterns passed to both audit and scan-diff steps

Fixed

• Close 9 scanner evasion bypasses found during red team testing: hex/base64-encoded secrets in URL query params and path segments, vowel-fold flag corruption on (?im) patterns, strip mode fail-open when detection came from non-redactable passes, and missing normalization passes on decoded response content (PR #135)
• Close 3 DLP evasion bypasses in query parameter scanning: iterative URL-decode, noise-stripped values, and dot-collapsed subdomain splits now applied to individual query keys and values (PR #134)

Changed

• Encoding attribution: segment-level DLP matches now carry correct encoding labels (hex, base64, base32) instead of always reporting "hex"
• Response scanning decoded-content path runs all normalization passes (primary, opt-space, vowel-fold), closing a gap where base64/hex-encoded vowel-substituted injection could bypass detection
• Logo tagline updated to "Agent Firewall"

Added

• MCP HTTP reverse proxy: --mcp-listen + --mcp-upstream flags on pipelock run create an HTTP-to-HTTP scanning proxy with bidirectional JSON-RPC 2.0 validation, Authorization header DLP scanning, and fail-closed parse error handling (PR #127)
• MCP standalone HTTP listener: pipelock mcp proxy --listen :8889 --upstream http://host/mcp for deployments that only need MCP scanning without the fetch/forward proxy (PR #127)
• JSON-RPC 2.0 structural validation on HTTP listener: rejects non-string method types, wrong/missing jsonrpc version, and missing method field with proper -32600 error codes; batch requests pass through to per-element scanning (PR #127)
• CI dogfooding: Pipelock's own GitHub Action runs on every PR, scanning diffs for exposed credentials and injection patterns (PR #126)

Fixed

• Release workflow: semver-only tag filter (v*.*.*) prevents floating tags like v1 from triggering spurious GoReleaser releases (PR #126)
• Auto-move v1 floating tag after each semver release so the GitHub Action always resolves to the latest version (PR #126)

Changed

• MCP auto-enable default: mcp_input_scanning.action changed from warn to block when auto-enabled in proxy mode, preventing credential forwarding in balanced configs (PR #127)
• Default response scanning and DLP patterns auto-populated when MCP listener enables scanning on an unconfigured section (PR #127)

Added

• HTTP forward proxy: standard CONNECT tunneling and absolute-URI HTTP forwarding on the same port as the fetch proxy. Set HTTPS_PROXY=http://localhost:8888 and all agent HTTP traffic flows through the scanner pipeline. Configurable tunnel duration and idle timeout controls (PR #123)
• Tunnel observability: Prometheus metrics (tunnel count, bytes transferred, duration histogram, active gauge), JSON stats, and structured audit logs for tunnel open/close events (PR #123)
• GitHub Action (luckyPipewrench/pipelock): composite action for CI/CD agent security scanning with checksum-verified binary download, multi-arch (amd64/arm64) and multi-OS (Linux/macOS) support, fail-closed audit gate, PR diff secret scanning, inline GitHub annotations on findings, and job summary (PR #125)
• CI workflow examples for basic and advanced GitHub Action usage (PR #125)

Changed

• Forward proxy enabled by default in all 6 preset configs: balanced, strict, audit, claude-code, cursor, generic-agent (PR #125)
• Action string constants extracted to config package (ActionBlock, ActionWarn, ActionAsk, ActionStrip, ActionForward), replacing ~70 hardcoded literals across 12 files (PR #124)
• README rewritten with forward proxy "zero code changes" quickstart as primary path, refreshed benchmarks and testing stats, honest security assessment section (PR #122, #125)
• Copyright updated to legal name in LICENSE (PR #122)

Added

• MCP --env flag: pass specific environment variables to child processes without exposing the full environment (PR #119)

Fixed

• Tool poisoning detection: instruction tag patterns (<IMPORTANT>, <system>) and dangerous capability patterns (file exfil, cross-tool manipulation) hardened via adversarial testing (PR #117)

Changed

• Rebrand from "security harness" to "agent firewall" across all user-facing surfaces: CLI, README, docs, demo, Homebrew formula (PR #120)
• Extract internal/normalize package: consolidate Unicode normalization pipeline, add ForPolicy variant for command matching (PR #116)
• Documentation refresh: updated comparison matrix, stale references, testing stats (PR #118)

Added

• MCP Streamable HTTP transport: pipelock mcp proxy --upstream <url> bridges stdio clients to remote MCP servers over HTTP with SSE stream support and session lifecycle management (PR #112)
• Pre-execution tool call policy: configurable mcp_tool_policy blocks dangerous commands (rm -rf, curl to external, chmod 777) before MCP tools execute, with pairwise token matching and whitespace normalization (PR #107)
• Known secret scanning: dlp.secrets_file config loads explicit secrets from file, scans URLs and MCP tool arguments for raw + base64/hex/base32 encoded variants including unpadded forms (PR #111)
• pipelock test CLI command: validates scanner coverage against loaded config with structured pass/fail output per scanner layer (PR #109)
• Framework integration guides: OpenAI Agents SDK, Google ADK, AutoGen (PR #110)
• GOVERNANCE.md, ROADMAP.md, and security assurance documentation for OpenSSF Silver (PR #108)
• OpenSSF Best Practices Silver badge (PR #114)

Fixed

• Unicode bypass in injection and DLP scanning: full homoglyph normalization (Cyrillic, Greek, Armenian, Cherokee), combining mark stripping, leetspeak normalization, 6 new injection patterns (PR #105)
• govulncheck CI flake: pinned Go version to 1.24.13 to prevent runner cache inconsistency (PR #113)
• Codecov targets raised to 95% project / 90% patch (PR #113)

Changed

• README Quick Start reordered: pipelock check before pipelock run since check doesn't need a running proxy (PR #113)
• CONTRIBUTING.md updated with complete CLI command list and project structure (PR #113)
• Demo script uses DEMO_TMPDIR instead of TMPDIR to avoid shadowing POSIX env var (PR #113)
• CI matrix tests Go 1.24 + 1.25 (PR #113)

Added

• MCP transport abstraction: MessageReader/MessageWriter interfaces decouple scanning from stdio framing, preparing for HTTP transport
• Demo command: 7 attack scenarios (was 5), adding MCP input secret leak and tool description poisoning demos
• Demo ANSI color output with NO_COLOR env var support and TTY detection
• Demo --interactive flag for live presentations (pauses between scenarios)
• CrewAI integration guide (docs/guides/crewai.md)
• LangGraph integration guide (docs/guides/langgraph.md)
• WriteMessage size guard (10 MB limit) prevents unbounded memory allocation on malformed input
• maxLineSize guard on stdio message reader for consistency with write path

Fixed

• Strict-mode API allowlist enforcement: requests to non-allowlisted domains now blocked in strict mode (was warn-only)
• MCP no-params DLP bypass: requests with missing params field bypassed input scanning entirely
• Encoded secret bypass in MCP input: multi-layer percent-encoding could evade DLP patterns
• Display URL normalization: audit log URLs now consistently decoded for readability
• Three static analysis findings: ViolationPermissions field visibility, HITL reload-to-ask warning, stale comment

Changed

• Demo "MCP Tool Poisoning" scenario renamed to "MCP Response Injection" for clarity
• iterativeDecode consolidated into single exported function (was duplicated across scanner paths)
• Write errors in syncWriter and StdioWriter now wrapped with context
• Bumped sigstore/cosign-installer from 3.10.1 to 4.0.0

Added

• MCP tool description scanning: detects poisoned tool descriptions containing hidden instructions (<IMPORTANT> tags, file exfiltration directives, cross-tool manipulation)
• MCP tool rug-pull detection: SHA256 baseline tracks tool definitions per session, alerts when descriptions change mid-session
• mcp_tool_scanning config section (action: warn/block, detect_drift: true/false)
• Auto-enabled in mcp proxy mode unless explicitly configured
• Unicode normalization (NFKC) and C0 control character stripping in tool description scanning
• Recursive schema extraction: scans description and title fields from nested inputSchema objects
• JSON-RPC batch response handling for tool scanning
• CODEOWNERS file for automatic review assignment
• Cosign keyless signing for release checksums (Sigstore transparency log)
• Manual trigger (workflow_dispatch) for OpenSSF Scorecard workflow

Fixed

• Fetch proxy URL parameter truncation: unencoded & in target URLs silently truncated secrets from DLP scanner
• Fetch proxy control character bypass: %00, %08, %09, %0a in target URLs broke DLP regex matching
• Empty-name tool bypass: tools with no name field bypassed tools/list scanning entirely
• Baseline capacity DoS: malicious servers could force hash computation on unlimited unique tool names (added capacity cap with ShouldSkip())

Changed

• Branch protection: squash-only merges, stale review dismissal

Added

• SLSA build provenance attestation for all release binaries and container images
• CycloneDX SBOM generated and attached to every release
• OpenSSF Scorecard workflow with results published to GitHub Security tab
• govulncheck CI job scanning Go dependencies for known vulnerabilities
• go mod verify step in CI and release pipelines
• OpenSSF Scorecard badge in README
• OpenSSF Best Practices passing badge in README
• Release verification instructions in README (gh attestation verify)

Changed

• All GitHub Actions pinned to commit SHAs (supply chain hardening)
• Release workflow now includes id-token and attestations permissions for provenance signing
• Explicit top-level permissions: contents: read in CI workflow (least privilege)
• Release attestation steps use continue-on-error with final verification (prevents cascading failures)
• Container digest resolution uses ::warning annotation instead of silent fallback
• govulncheck, cyclonedx-gomod, and crane pinned to specific versions (not @latest)
• Docker base images pinned by SHA256 digest (Scorecard Pinned-Dependencies)
• Write permissions moved from workflow-level to job-level (Scorecard Token-Permissions)
• Branch protection: added PR requirement, lint as required check, strict status policy, review thread resolution

Fixed

• Fetch proxy DNS subdomain exfiltration: dot-collapse scanning now applied to hostnames in checkDLP (was only on MCP text scanning side)
• MCP content block split bypass: ExtractText now joins blocks with space separator (was \n, allowing between-word injection splits to evade detection)
• Git DLP case sensitivity: CompileDLPPatterns now applies (?i) prefix, matching URL scanner behavior
• Rate limiter subdomain rotation: checkRateLimit now uses baseDomain() normalization, preventing per-subdomain rate limit evasion
• Response scanning Unicode whitespace bypass: added normalizeWhitespace() for Ogham space (U+1680), Mongolian vowel separator (U+180E), and line/paragraph separators
• Agent name path traversal: ValidateAgentName now rejects names containing .. or equal to .
• URL DLP NFKC normalization: applied norm.NFKC.String() before DLP pattern matching, consistent with response scanning

Added

• MCP input scanning: bidirectional proxy now scans client requests for DLP leaks and injection in tool arguments
• mcp_input_scanning config section (action: warn/block, on_parse_error: block/forward)
• Auto-enabled in mcp proxy mode unless explicitly configured
• Iterative URL decoding in text DLP (catches double/triple percent-encoding)
• Method name and request ID fields included in DLP scan coverage
• OPENSSH private key format added to Private Key Header DLP pattern
• Split-key concatenation scanning: detects secrets split across multiple JSON arguments
• DNS subdomain exfiltration detection: dot-collapse scanning catches secrets split across subdomains
• Case-insensitive DLP pattern matching: prevents evasion via .toUpperCase() or mixed-case secrets
• Null byte stripping in scanner pipeline: prevents regex-splitting bypass via \x00 injection
• 55+ new tests for input scanning, text DLP, and config validation

Changed

• CI workflow: removed redundant go vet and go mod verify steps, combined duplicate test runs, added job timeouts
• Audit preset on_parse_error changed from block to forward (consistent with observe-only philosophy)
• Config validation rejects ask action for input scanning (no terminal interaction on request path)
• CLI auto-enable checks both enabled and action fields (unconfigured = both at zero values)

Added

• Audit log sanitization: ANSI escapes and control characters stripped from all log fields (internal/audit/logger.go)
• Data budget enforcement per registrable domain (prevents subdomain variation bypass)
• Hex-encoded environment variable leak detection
• Container startup warning when running as root
• HITL channel drain before each prompt (prevents stale input from prior timeout)
• DLP patterns for github_pat_ fine-grained PATs and Stripe keys ([sr]k_(live|test)_)
• Fuzz test for audit log sanitizer
• Integrity manifest path traversal protection
• 970+ tests passing with -race

Security

• MCP proxy fail-closed: unparseable responses now blocked in all action modes (was forwarding in warn/strip/ask)
• MCP batch scanning fail-closed: parse errors on individual elements now propagate as dirty verdict
• MCP strip recursion depth limit (maxStripDepth=4) prevents stack overflow from nested JSON arrays

Fixed

• DLP pattern overlap: OpenAI Service Key narrowed to sk-svcacct- (was sk-(proj|svcacct)-, overlapping with existing sk-proj- pattern)
• Redirect-to-SSRF: blocked flag now set on redirect hops (redirect to private IP was not caught)
• Rate limiter returns HTTP 429 Too Many Requests (was returning 403)
• io.Pipe resource leak in HITL tests

Removed

• SKILL.md (external skill-registry listing discontinued)

Added

• --json flag for git scan-diff command (CI/CD integration)
• Fuzz tests for 8 security-critical functions across 4 packages
• 660+ tests passing with -race

Security

• IPv4-mapped IPv6 SSRF bypass: ::ffff:127.0.0.1 now normalized via To4() before CIDR matching
• MCP ToolResult schema bypass: result field uses json.RawMessage with recursive string extraction fallback
• MCP zero-width Unicode stripping applied to response content scanning
• DNS subdomain exfiltration: DLP/entropy checks now run on hostname before DNS resolution
• --no-prefix git diff bypass: parser accepts +++ filename without b/ prefix
• MCP error messages (error.message and error.data) now scanned for injection
• Double URL encoding DLP bypass: iterative decode (max 3 rounds) on path segments
• Default SSRF CIDRs: added 0.0.0.0/8 and 100.64.0.0/10 (CGN/Tailscale)
• CRLF line ending normalization in git diff parsing
• ReadHeaderTimeout added to HTTP server (Slowloris protection)
• Non-text MCP content blocks now scanned (was skipping non-text types)

Fixed

• Homebrew formula push: use HOMEBREW_TAP_TOKEN secret for cross-repo access

Added

• pipelock audit command: scans projects for security gaps, generates score (0-100) and suggested config (internal/projectscan/)
• pipelock demo command: 5 self-contained attack scenarios (DLP, injection, blocklist, entropy, MCP) using real scanner pipeline
• OWASP Agentic AI Top 15 threat mapping (docs/owasp-agentic-top15-mapping.md, 12/15 threats covered)
• 14 scanner pipeline benchmarks with make bench target (~3 microseconds per allowed URL)
• Grafana dashboard JSON (configs/grafana-dashboard.json, 7 panels, 3 rows)
• SVG logo
• Public contributor guide (CLAUDE.md)
• CONTRIBUTING.md expanded with detailed development workflow
• 756+ tests passing with -race

Fixed

• Audit score: critical finding penalty (-5 per leaked secret found)
• DLP pattern compilation deduplication
• Follow mode context-aware shutdown in logs command
• Blog links updated from GitHub Pages to pipelab.org
• OWASP mapping updated to 2026 final category names

Added

• MCP stdio proxy mode: pipelock mcp proxy -- <command> wraps any MCP server, scanning responses in real-time (internal/mcp/proxy.go)
• Human-in-the-loop terminal approvals: action: ask prompts for y/N/s with configurable timeout (internal/hitl/)
• Agent-specific config presets: configs/claude-code.yaml, configs/cursor.yaml, configs/generic-agent.yaml
• Claude Code integration guide (docs/guides/claude-code.md)
• Homebrew formula in GoReleaser config
• Asciinema demo recording embedded in README

Fixed

• Makefile VERSION fallback: git describe failure no longer produces empty version string
• OpenAI API key DLP regex: now matches keys containing - and _ characters
• HITL approver data race: single reader goroutine pattern eliminates concurrent bufio.Reader access on timeout
• GoReleaser v2: folder renamed to directory in Homebrew brews config

Added

• File integrity monitoring for agent workspaces (pipelock integrity init|check|update)
• SHA256 manifest generation with glob exclusion patterns (** doublestar support)
• Integrity check reports: modified, added, and removed file detection
• JSON output mode for integrity checks (--json flag)
• Custom manifest path support (--manifest flag)
• Atomic manifest writes (temp file + rename) to prevent corruption
• Manifest version validation and nil-files guard on load
• Ed25519 signing for file and manifest verification (pipelock keygen|sign|verify|trust)
• Key storage under ~/.pipelock/ with versioned format headers
• Trusted key management for inter-agent signature verification
• Path traversal protection in keystore operations
• MCP JSON-RPC 2.0 response scanning for prompt injection (pipelock mcp scan)
• MCP scanning: text extraction from content blocks, split-injection detection via concatenation
• MCP scanning: --json output mode (one verdict per line) and --config flag
• Blog at pipelab.org/blog/
• 530+ tests passing with -race

Fixed

• DLP bypass: secrets in URL hostnames/subdomains now scanned (full-URL DLP scan)
• DLP bypass: secrets split across query parameters now detected
• README: corrected signing CLI syntax, agent types, health version example
• GoReleaser: added missing BuildDate/GitCommit/GoVersion ldflags
• Blog: fixed hallucinated product name, removed stale "coming next" reference

Security

• json.RawMessage null bypass prevention (MCP result always scanned regardless of error field)

Removed

• Stale Phase 1.5 planning doc (planning docs live outside the repo)

Added

• CodeQL security scanning workflow
• Codecov coverage integration and badge
• Go Report Card badge

Fixed

• All 53 golangci-lint warnings resolved (zero-warning CI baseline)
• 363 tests passing with -race

Changed

• CLI commands write to cmd.OutOrStdout() instead of os.Stdout (cobra-idiomatic)
• run command uses cmd.Context() as signal parent for testability

Added

• Run command integration test (config loading, flag overrides, health check, graceful shutdown)
• Docker Compose YAML syntax validation test (all agent templates parsed via yaml.Unmarshal)
• Base64url environment variable leak detection test
• Rate limiter window rollover test
• Healthcheck command test against running server
• 363 tests passing with -race

Added

• Fetch proxy server with /fetch, /health, /metrics, and /stats endpoints
• URL scanning pipeline: scheme check, SSRF protection, domain blocklist, rate limiting, URL length, DLP regex, Shannon entropy
• SSRF protection with configurable CIDR ranges (IPv4 + IPv6), fail-closed DNS resolution, DNS rebinding prevention via pinned DialContext
• DLP pattern matching for API keys, tokens, secrets (Anthropic, OpenAI, GitHub, Slack, AWS, Discord, private keys, SSNs)
• Shannon entropy analysis for detecting encoded/encrypted data in URL segments
• Environment variable leak detection: scans URLs for high-entropy env var values (raw + base64-encoded)
• Domain blocklist with wildcard support (*.pastebin.com)
• Per-domain rate limiting with sliding window and configurable max_requests_per_minute
• Response scanning: fetched page content scanned for prompt injection patterns (block/strip/warn actions)
• Multi-agent support: X-Pipelock-Agent header identifies calling agents; agent name included in audit logs and fetch responses
• Agent name sanitization to prevent log injection
• Structured JSON audit logging via zerolog (allowed, blocked, error, anomaly, redirect events)
• YAML configuration with validation and sensible defaults
• Config hot-reload via fsnotify file watching and SIGHUP signal (when using --config)
• Hot-reload panic recovery: invalid config reloads are caught and logged without crashing the proxy
• Three operating modes: strict, balanced (default), audit
• CLI commands: run, check, generate config, generate docker-compose, logs, git scan-diff, git install-hooks, version, healthcheck
• Config presets: configs/balanced.yaml, configs/strict.yaml, configs/audit.yaml
• Docker Compose generation for network-isolated agent deployments (pipelock generate docker-compose)
• HTML content extraction via go-readability
• Redirect following with per-hop URL scanning (max 5 redirects)
• Graceful shutdown on SIGINT/SIGTERM
• Prometheus metrics: pipelock_requests_total, pipelock_scanner_hits_total, pipelock_request_duration_seconds
• JSON stats endpoint: top blocked domains, scanner hits, block rate, uptime
• Build metadata injection via ldflags (version, date, commit, Go version)
• Docker support: scratch-based image (~15MB), multi-arch (amd64/arm64), GHCR via GoReleaser
• GitHub Actions CI (Go 1.24 + 1.25, race detector, vet)
• 345 tests with -race