Signed, versioned detection rules for Pipelock, the open-source agent firewall.

Pipelock ships with built-in DLP, injection, and tool-poison scanners. Rule bundles extend those defaults with patterns that ship on a faster cadence than the core binary. Bundles are Ed25519-signed, versioned, and additive: they add detections and never override or weaken a built-in one.

Install

Any published bundle installs by name from the Pipelock registry at https://pipelab.org/rules/:

pipelock rules install <bundle>

Published so far. Each is a separate block, because you almost certainly want one of them rather than both:

pipelock-community — credentials, prompt injection, and MCP tool poisoning.

pipelock rules install pipelock-community

healthcare-phi-pii — PHI and PII for healthcare agents.

pipelock rules install healthcare-phi-pii

That is the whole install. Pipelock verifies the signature against the keyring compiled into its release binary before the bundle loads, so there is nothing further to check by hand.

base=https://github.com/luckyPipewrench/pipelock-rules/releases/latest/download
curl -fsSLO "$base/pipelock-community-bundle.yaml"
curl -fsSLO "$base/pipelock-community-bundle.yaml.sig"
curl -fsSLO "$base/SHA256SUMS"
grep -E '  \./pipelock-community-bundle\.yaml(\.sig)?$' SHA256SUMS | sha256sum -c -

mkdir -p verify/agents/pipelock-official
curl -fsSLo verify/agents/pipelock-official/id_ed25519.pub \
  https://raw.githubusercontent.com/luckyPipewrench/pipelock-rules/main/.github/rules-official/pipelock-official.pub
printf '%s  %s\n' d63673b9fb7546dd5f223dc8df3b39a51eb8298d914fc602ba75c5d22910dd9f \
  verify/agents/pipelock-official/id_ed25519.pub | sha256sum -c -

pipelock verify pipelock-community-bundle.yaml \
  --sig pipelock-community-bundle.yaml.sig \
  --keystore verify --agent pipelock-official

pipelock rules install --source "$base/pipelock-community-bundle.yaml" pipelock-community

What's in each bundle

pipelock-community is the official community bundle: credential patterns for providers Pipelock does not cover by default, such as 1Password, Doppler, Pulumi, Shopify, and Vercel; prompt-injection techniques including non-English overrides; and MCP tool-description poisoning.

healthcare-phi-pii is a healthcare DLP bundle contributed by BGASoft, Inc. It covers the regex-detectable entries from HIPAA Safe Harbor's 18 identifiers, financial PII, and clinical laboratory identifiers.

Every rule, with what it detects, its severity, and its primary source, is listed in the rule catalog. That page is generated from the compiled bundles, so it cannot fall behind them.

Stable rules are enabled by default. Experimental rules are not, because they carry only true-positive fixtures and may fire on traffic you consider benign. Turn them on when you want the wider net:

rules:
  include_experimental: true

How a rule gets in

The point of the pipeline is that a rule's claims are executable. A regex that matches nothing, or that matches ordinary traffic, fails before review ever sees it.

Anatomy of a rule

A rule is a small YAML file: an identifier, what it detects, how severe a match is, the field it reads, and an RE2-compatible pattern. Next to it live the fixtures, one test string per line, that decide whether it is allowed to ship.

Trust

Official bundles are verified against the keyring compiled into Pipelock release binaries. Third-party bundles are verified against keys you list in trusted_keys. Installing writes a bundle.lock recording what you actually got.

Creating your own bundle

Anyone can publish a bundle. Security teams write internal ones for company-specific credentials; researchers publish them for new attack patterns. Three rule types are supported:

# Install a third-party bundle from an HTTPS URL
pipelock rules install --source https://example.com/bundles/acme-rules/bundle.yaml acme-rules

# Install from a local path while you are still writing it
pipelock rules install --path ./my-bundle/ --allow-unsigned

# List what's installed
pipelock rules list

See the full bundle authoring guide for the YAML schema, signing, distribution, and trust model.

Compatibility contract

The maintained bundles are tested from their declared min_pipelock through Pipelock 3.5.0. A newer Pipelock release sits outside this tested range. It should warn and continue unless it can't read the bundle format. Pipelock 3.5.0 doesn't expose that warning yet, so compatibility/contract.yaml records the tested ceiling until a product update adds it.

The contract binds each published bundle's name, CalVer, minimum version, and format_version to a SHA-256-pinned reader-schema identity. The two bundles named in the contract add detections. They don't carry per-rule allow or block actions, and they can't replace built-in patterns. Format 1 has no monotonic rollback counter. The installer refuses a same-version digest change.

Run make check-compatibility to check that binding and exercise the installer with two pinned bundles, one format-1 optional-field fixture, and four negative cases: same-version digest change, unsupported format, too-new minimum, and unknown reader field. make preflight includes the check.

Development

# Compile individual rule files into a single bundle
make compile

# Compile a specific bundle
BUNDLE_NAME=healthcare-phi-pii make compile

# Validate the compiled bundle against the Pipelock schema
make validate

# Run every regex against its true and false positive fixtures
make test-fixtures

# Re-render the README diagrams and the rule catalog from the live bundles
make diagrams

# Everything CI runs locally, for every published bundle
make preflight

make preflight requires a Pipelock CLI on your PATH. It never downloads one, so a missing binary is a clear prerequisite failure rather than a silently skipped schema check.

Repository layout

rules/<bundle>/<type>/       One YAML file per rule
fixtures/<bundle>/<type>/    Lines that must match, and lines that must not
published/<bundle>/          The compiled bundle.yaml and its detached .sig
assets/                      README diagrams, generated by scripts/render_diagrams.py
scripts/compile.sh           Merges rule files into bundle.yaml
scripts/test-fixtures.sh     Runs every regex against its fixtures

Learn more

• What is an Agent Firewall?: how Pipelock scans agent traffic
• Community Rules: install guide and rule documentation
• MCP Tool Poisoning: why tool-poison rules exist
• Pipelock on GitHub

Contributing

See CONTRIBUTING.md for how to add a rule. Every rule needs:

• An RE2-compatible regex (no lookahead, no backreferences)
• At least one true-positive fixture
• A primary source citation (stable rules)
• At least one false-positive fixture (stable rules)

License

Apache 2.0. See LICENSE.