PipeLab builds Pipelock, an open-source firewall that sits between AI agents and the outside world, and maintains a set of open agent-security projects. It is aimed at operators who run coding agents with access to real secrets and want to control what those agents send out, what content comes back in, and what evidence is kept of each action.
The risk it addresses is simple to state: an agent that can read secrets and reach the internet can leak them, and an agent that reads untrusted content can be steered by it.
At A Glance
| Vendor | PipeLab |
|---|---|
| Category | AI agent security, agent egress firewall |
| Identities covered | AI agents and the secrets they handle |
| Deployment | Self-hosted single Go binary, Kubernetes |
| Agentic AI | MCP mediation, per-agent identity, signed action receipts |
| Licence | Apache-2.0 core |
| Market classification | Agentic AI Identity; also AI Governance & Compliance |
What PipeLab Does
An AI coding agent can leak an API key in an outbound request, follow instructions hidden in a web page, or call an MCP tool whose description has quietly changed. PipeLab’s answer is to put an inspection point in the agent’s path, so that every request out and every response in passes through one place that can block it and record it. The agent itself does not need to be trusted or modified. The work is guided by the principle “Build what you can inspect”: the core is open source, and the company publishes the benchmark and detection rules it uses, so buyers can check the controls rather than take them on faith.
Products
Pipelock
Pipelock is the agent firewall itself. One engine checks URLs, headers, request bodies, WebSocket frames and MCP tool arguments.
- Detects secrets split across several requests, not only those in a single call
- Scans responses for prompt injection before untrusted content reaches the agent
- Alerts on or blocks MCP tool descriptions that change during a session
- Uses canary tokens, configured synthetic secrets that reveal exfiltration attempts
Pipelock Pro
Pro is for a single operator running several agents. It adds unlimited named profiles, each with its own policies, budgets and audit trail.
Pipelock Conductor
The Conductor, part of Enterprise, is a fleet control plane with central policy and a dashboard for teams running Pipelock across many agents.
- Pushes signed policy bundles to every follower instance
- Provides an emergency remote kill that requires M-of-N signatures
- Collects signed records from enrolled agents
Pipelock Assess
Assess tests how well a Pipelock deployment is configured. It runs 30 adversarial scenarios against the configuration, scores 23 hardening categories and maps findings to 7 frameworks.
Open-Source Projects
| Agent Egress Bench | A tool-neutral benchmark for testing agent egress controls against public attack cases, with 251 cases in 18 categories |
|---|---|
| Pipelock Rules | Community detection patterns distributed as signed YAML bundles |
| Agent Evidence Level | An open draft standard for grading AI-agent audit evidence |
How It Works
Pipelock is self-hosted and runs as a proxy in front of the agent.
| Component | What it does |
|---|---|
| Pipelock binary | A single Go binary, with a Kubernetes chart published alongside each release. |
| Mediation | Agent traffic over MCP, HTTP and WebSocket passes through Pipelock, which runs separate listeners and policy profiles for named agents. |
| Evidence | Pipelock writes signed, hash-chained mediation evidence that can be verified offline. When receipt signing is configured, each action gets a signed receipt that a third party can check. Assessments are signed with Ed25519; the signature proves what Pipelock recorded, not that the action itself ran. |
| Conductor | The control plane runs from the same binary as pipelock conductor commands and distributes policy to follower instances. |
Identities And Systems Covered
| AI agents | Each agent enrolled under Enterprise joins with its own one-time pass and receives its own identity. |
|---|---|
| Secrets | API keys and other secrets in agent egress traffic, plus synthetic canary secrets. |
| Agent clients | Claude Code, Cursor, VS Code, JetBrains and local stdio MCP servers, plus any agent that speaks HTTP or WebSocket. |
| Protocols | MCP, HTTP and WebSocket. |
Company Background
| Origin | PipeLab began as a homelab project rather than a startup. |
|---|---|
| Licensing | The Pipelock core is Apache-2.0 licensed. |
| Support | Enterprise support is asynchronous, with a response target. |
Note: This overview is compiled from PipeLab’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.