Put pipelock in front of any agent that holds credentials and can reach the network: it scans requests before they leave (65 DLP patterns, run before DNS so secrets can't leak through lookups), scans responses for injection, wraps MCP servers with `pipelock mcp proxy`, and writes hash-chained, signed receipts you can verify offline. It is unusually candid about its limits — read them. It only sees traffic routed through it, so pair it with enforced egress (network policy, a sandbox, or its own Landlock/netns containment) or an agent can simply go around it; without TLS interception, CONNECT traffic is checked only at hostname/URL level. Open-core: the Apache-2.0 core is the proxy; the fleet dashboard and Conductor are ELv2 and license-gated. Not a model guardrail — for prompt/output rails use nemo-guardrails.