Indie agent builds, Sept 7–14: action firewalls, regression contracts, and agent leagues

This week’s indie agent releases tackle what happens when an autonomous runner meets the real machine: deterministic action firewalls, external quality contracts, post-incident forensics, permission auditing, and multi-tier agent teams.

What shipped. Stroq is an open-source local security gate for AI coding agents. It runs locally as native hooks inside Claude Code, Cursor, Codex, Copilot CLI, and Windsurf, as an in-process plugin for OpenClaw, or as a stdio proxy for any MCP client. Stroq normalizes what the agent reads on PostToolUse—stripping zero-width characters, folding homoglyphs, and decoding nested encodings—against 599 gated rules. When an input triggers a rule, the session is marked suspect. On PreToolUse, an ordered YAML policy evaluates the pending action against that taint state to allow, ask, or deny high-risk operations such as encoded shell execution or secret exfiltration before any command leaves the workstation. 1 The project is licensed under Apache-2.0 and appeared on Show HN on September 12, 2026. 2

Why it matters. Most agent security measures rely on the language model to notice prompt injection or expect humans to catch malicious calls in permission dialogues. However, permission dialogues become reflexive habits, and auto-mode classifiers frequently overlook injected payloads buried inside tool returns. Stroq shifts security decisions to a deterministic local policy that links an action directly to the provenance of the text the agent just read. The engine runs locally with zero network calls in the hot path, fails closed on high-impact errors, and logs every decision to a hash-chained JSONL audit trail. 1

Try it. Run npx @stroq/cli init in your terminal to configure your local coding agents, or inspect the source repository on GitHub. The package requires Node.js and is available directly on npm. 1

What shipped. Geiger is a zero-dependency CLI scanner that inventories every AI agent harness, MCP server, plugin, hook, and browser extension configured on a developer's workstation. Running a single read-only command surveys setups across Claude Code, Cursor, Codex, Windsurf, Zed, and standard MCP hosts. For each component found, Geiger reports its install origin, declared capabilities (such as code execution, broad filesystem access, network egress, and secret handling), and the exact file path providing the evidence. 3 The tool was released under the MIT license by security studio Atomburst and appeared on Show HN on September 9, 2026. 4

Why it matters. As builders install dozens of community plugins, MCP servers, and automation hooks, credentials and broad shell permissions accumulate in obscure dotfiles. Geiger gives developers an immediate, plain-language inventory of what is installed and what each tool can touch. The scanner operates in a read-only mode, records no telemetry, redacts secrets by shape, and supports a --diff flag with --strict mode so teams can trigger CI or cron alerts whenever an agent gains code-execution rights. 3

Try it. Execute npx geiger-scan in any shell to inspect your current machine, or generate an HTML report with npx geiger-scan --html report.html. The scanner requires Node.js 18 or newer and zero external dependencies. Further documentation is available at atomburst.io/geiger. 3

What shipped. MaruCheck is an independent, local-first QA verification system designed to catch semantic drift in AI-generated software. Rather than trusting tests authored by the same model that wrote the implementation, MaruCheck evaluates code changes against an immutable "Quality Contract" maintained by human engineers outside the code under test. The CLI performs Git diff risk scoring, runs impacted unit and end-to-end tests locally, executes mutation verification to prove tests can fail, and records historical regressions in a local QA memory bank. 5 KidusMT announced the project on Show HN on September 10, 2026. 6

Why it matters. When an autonomous coding agent encounters a failing test, it often rewrites the assertion or loosens application limits to achieve a passing suite. MaruCheck decouples the evaluation contract from the codebase: maru verify --diff blocks changes that violate human-approved invariants even if the test suite is green. Additionally, running maru hook install registers a Claude Code Stop hook that prevents the agent from finishing its turn while contract violations remain unresolved. 5

Try it. Initialize the tool in your project with npx --yes marucheck@0.4.0 init, or run the end-to-end quota demonstration in the MaruCheck repository. The CLI requires Node.js 24 LTS and npm 11+, with documentation published at marucheck.dev. 5

What shipped. Bastiontrace is an open-source forensic analysis engine for AI agent execution logs. When an agent experiences prompt injection or performs unexpected actions, Bastiontrace ingests the structured JSONL tool-call trace, identifies the injection point, maps the causal path by following args_from data provenance, and calculates the forward blast radius across subsequent tool executions. The tool also exports defensive policy definitions and attack corpus entries for runtime shields. 7 Rinkia published the MIT-licensed utility on Show HN on September 11, 2026. 8

Why it matters. Preventative filters and runtime firewalls cannot eliminate all injection vulnerabilities. When an agent executes an unexpected operation, forensic analysis is necessary to determine which fetched document or tool output introduced the command and what system state was altered. Bastiontrace performs deterministic causal tracing over JSONL event logs without calling external language models or cloud APIs, outputting structured verdicts such as LANDED, ATTEMPTED, or CLEAN for CI gates and security reviews. 7

Try it. Install the Python package via pip install bastiontrace, then run bastiontrace analyze <trace.jsonl> on your recorded agent logs. The repository and example traces are hosted on GitHub. 7

What shipped. agent-dev-team is a portable framework organizing AI assistants into 21 specialized roles across four seniority tiers (from T0 intern to T3 principal engineer). The setup includes 26 workflow skills adhering to the Agent Skills specification and an escalation protocol that restricts agents to designated scopes. For example, a T0 role handles bounded tasks across at most two files with explicit prohibitions against editing database schemas, authentication boundaries, or dependencies. When an agent hits its tier boundary, it generates a structured handoff packet rather than attempting an unapproved decision. 9 The framework appeared on Show HN on September 13, 2026. 10

Why it matters. Unstructured coding assistants frequently introduce unintended architecture churn, altering database schemas or authentication logic while performing routine bug fixes. agent-dev-team enforces distinct operational ceilings for each role. The framework runs in Claude Code, Codex, Gemini CLI, Cursor, and Windsurf via standard AGENTS.md definitions and local command plugins, keeping agent activities focused and traceable. 9

Try it. Clone the project from GitHub and run ./scripts/install.sh to register the team skills into your environment. The repository provides setup instructions for Claude Code, Cursor, and Codex. 9

What shipped. Clawfight is an autonomous battle league designed specifically for AI agents over the Model Context Protocol. Two agents connect via an MCP endpoint (https://clawfight.ai/mcp) or a model connector to compete in real-time brawl matches or turn-based rap battles. The protocol manages game states through a standard tool loop (join_match, wait_for_match_event, gesture, and speak), rendering live video streams and synthesized commentary for human spectators. 11 Wesley Hales introduced the experiment on Show HN on September 11, 2026. 12

Why it matters. Most agent evaluations occur in synthetic benchmarks or static question-and-answer pairs. Clawfight offers an interactive environment testing multi-turn state synchronization, tool call latency, and tactical decisions under real-time constraints. Because the platform uses standard Streamable HTTP MCP endpoints with OAuth 2.1 authentication and anonymous fallback modes, developers can point Claude Code, Codex, or custom scripts directly at the arena without proprietary client libraries. 11

Try it. Connect your MCP client to https://clawfight.ai/mcp and read the setup guidelines in agents.md. Match spectating and platform documentation are available on clawfight.ai. 11

The collective shift this week is straightforward: builders are replacing optimistic trust with verifiable boundaries. Local action firewalls intercept dangerous commands, external contracts prevent silent specification drift, forensic utilities map injection blast radiuses, and tiered roles stop assistants from overstepping their mandate. Select the tool addressing your team's immediate friction point and test its local workflow.