A runtime firewall for AI coding agents is the missing control on a developer laptop: it sits in the call path and decides this exact tool call, right now. We built that control. It is called Airlock. It ships from Agentoffense, the same offensive team that tests agents for a living.
What changed on the machine
A year ago most coding assistants proposed a diff and waited. Claude Code, Cursor, Windsurf, Cline and Codex now run with the developer’s privileges. They read the repo, spawn a shell, talk to MCP servers nobody on the team inventoried, and treat a tool description as an instruction. That is not a chatbot. That is a privileged process that happens to be steered by English.
The failure mode is boring, which is why it keeps working. A skill with a clean SKILL.md reaches for ~/.ssh/id_rsa on the third tool call. A trusted MCP server ships a new description overnight and the old allow-list still matches the name. An untrusted GitHub issue drives an agent step that holds a publish token. None of that requires “hacking the model”. The agent is already allowed to do the damage.
We kept finding that gap on AI agent penetration testing engagements. So we stopped waiting for a vendor to close it and wrote the gate.
Why a scanner and a network gateway both miss this
Static scanners still have a job. They look at a skill or a package once, before install. That is the wrong moment for the class of bug we care about. A file that reads fine can behave badly the instant it executes. Nothing in that scan sits in the call path and asks “this exact call, right now”.
A network MCP gateway still has a job too. It sees HTTP and SSE. It does not see a local stdio MCP server on the laptop. It does not see Claude Code’s native Bash, Read or Write. cat ~/.ssh/id_rsa is not a network event. If your control plane only watches egress, that call never shows up.
The approval dialog, when it exists, is usually drawn by the agent that wants permission. Call that Lies-in-the-Loop. Padding pushes the real command off screen. A fake “security review looks clean” line sits above git push --force. You approved a story. The argv was something else. A path firewall does not close that. Neither does asking the agent nicely.
That is the last mile. Airlock is built for it.
What Agentoffense is, in one paragraph
Agentoffense is a lab, not a slogan. The services side is manual, exploit-driven testing of applications, APIs, cloud and the new agent surface: prompt injection testing, MCP server security testing, agentic threat modeling. The product side is the stack we wished existed while we were writing those reports. Airlock at runtime. Countersign for honest human consent. agentpipe for the CI chain where an untrusted GitHub event can drive an agent that holds secrets.
We work across Europe. The English product home is this site. The pentest work is the same people. That matters because a firewall written by people who have not broken the thing it gates will over-claim. We would rather print the limits in public than have you find them on a Friday incident.
What a runtime firewall for AI coding agents actually does
Airlock is a small proxy plus a hook. The MCP stdio proxy sits in the agent-to-server pipe. On Claude Code, a PreToolUse hook also gates native file and shell tools. Both paths hit the same policy engine. Unambiguous danger is blocked by deterministic rules: secret paths, rm -rf /, known collectors, cloud-metadata SSRF, log erasure, download-and-execute. Nested arguments are checked, not just the obvious field. Paths are normalised (NFKC, percent-decoded to a fixpoint), so %25252essh and a look-alike dot are the same as .ssh.
Three postures, one install
A firewall that blocks everything on day one gets uninstalled on day two. Airlock is built to be lived with.
yolo/ observe: log everything, block nothing. Week one. You learn what the agents actually do.default/ guard: block the dangerous, allow the rest, ask on the gray zone.paranoid/ enforce: default-deny. Unmatched calls wait for a human.
Run a week in observe, then airlock policy propose writes the narrowest policy that still covers real work. A user grant can never lift an absolute block. That sentence is the whole product, in policy terms. airlock uninstall restores every file it touched, byte for byte. If it shows up in your git diff, we failed.
Rug-pulls are held, not “detected”
A detection that does not stop the next call is not a control. Airlock pins an MCP server’s toolset on first trust (TOFU). If a trusted server silently ships a new description, every subsequent call is held until a human approves the change. The hold is the feature. A dashboard badge is not.
The log is evidence, not telemetry
Every decision lands in a hash-chained, signable log. airlock verify proves nothing was rewritten. Export to CEF and syslog exists if you already have a SIEM. Nothing is required to leave the machine. That is the point for teams that cannot send source or prompts to a third-country “AI guardrail”.
Article 12 of the EU AI Act, in force since 2 August 2026, asks high-risk systems for automatic, tamper-evident logs. Airlock is not a compliance certificate. It is a local, checkable ledger of what the agent was allowed to do. If you need an attestation letter for an audit, that is still a scoped engagement, not a CLI flag.
How a call is decided
Rules first. They are fast and boring, which is what you want for cat ~/.ssh/id_rsa. Overhead, measured: policy decision p50 25 microseconds; about 0.489 ms added to an MCP call; 27 MB peak RSS. In our bench, 50,000 gated calls at about 1,200 per second with flat memory. Reproduce it with airlock bench. One model turn is hundreds of milliseconds. If someone tells you a local gate will “slow the developers down”, ask them to run the bench.
The painful part is the gray zone: a chmod -R 777, a curl to a host you have never seen, a skill that started clean and then drifted. Version 0.6.0 ships an optional local judge, a 3B model packed as a llamafile. It only ever tightens a decision (ask becomes block). If it is slow or missing, the rules stand. Nothing is sent to a cloud. You can skip the model entirely. The deterministic rules still run.
Around the judge
airlock monitoris a live dashboard with per-agent attribution, so you can see which agent is the noisy one.airlock analyzegrades a window of the log clean / notable / suspicious.airlock watchputs that on cron.airlock breachreconstructs an incident from the signed log, grades evidence CONFIRMED / PROBABLE / POSSIBLE, checks log integrity first, and prints a rotation checklist. Read-only, so forensics does not write to the scene.airlock scanflags injection, secret-access, exfil and stealth indicators in skill and tool-description text at admission. Indicators for a human, not a magic verdict.
Coverage, stated precisely
One command wraps the MCP servers of the agents below, so their tool calls run through the gate (verified against the installed CLIs). Claude Code additionally gets its native file and shell tools gated through its PreToolUse hook. For the other agents, Airlock gates their MCP calls, not yet their built-in tools. If a vendor page tells you otherwise, they are not describing this tool.
| Agent | MCP | Native file/shell |
|---|---|---|
| Claude Code | gated | gated (PreToolUse hook) |
| Cursor, Windsurf, Cline, Codex | gated | not yet |
| Kimi, grok, mimo, DeepSeek Harness | gated | not yet |
HTTP/SSE MCP is not gated yet, only stdio. An agent with a shell can still open its own socket. Same-uid forgery is OS territory. We give you the proof in the log, not a kernel sandbox. Those rows are the sales document. Hide them and a CISO will find them anyway, then trust nothing else you said.
What Airlock does not do
Airlock does not stop prompt injection. Nothing honest does. It gates the action the injection asks for. Between “the agent was fooled” and “the key left the laptop” there has to be a control. That control is the product. If someone sells you “prompt injection protection” that never sees the tool call, they are selling a story about the model, not a gate on the machine.
It is not a replacement for Snyk, Wiz, or a network MCP gateway. Those close the artifact and the network. Ask them what happens when the agent calls Bash with cat ~/.ssh/id_rsa. That call does not go through their gateway. We close that mile. We do not replace them.
It is not fleet SSO, a hosted SIEM, or a SOC 2 report on a SaaS. There is no SaaS in the local product. Airlock makes no required outbound request except an optional indicator-feed update you can disable or mirror inside. We do not have your data because we never saw it.
Commercial packaging (team policy, hosted feeds, support) is a later conversation. It is not a launch claim. The CLI on one machine stays Apache-2.0.
The rest of the stack
Airlock is policy: what a call is allowed to do. Two neighbours close holes it leaves open.
Countersign draws the human-approval dialog from the real argv, not from the agent’s summary of it. Your yes is bound to a digest of that command. Every yes becomes a receipt in a hash-chained ledger. If the agent can lie about the ask, the firewall’s “ask” path is only as honest as the dialog. Countersign is that dialog.
agentpipe finds the chain in CI: untrusted GitHub event to AI-agent step to secret, write or publish. Free CLI and Action. Org-wide App if you want a dashboard and a policy a single repo cannot quietly weaken. That is a different cut from the laptop gate. Teams that put Claude in GitHub Actions with a publish token need both.
Install, without touching your secrets
pipx install airlock-agent
airlock demo # blocks a poisoned skill stealing an SSH key
airlock setup # pick posture and whether you want the local judge
airlock doctor # green checks mean the gate is actually onairlock demo does not read your keys. It runs a poisoned skill against a throwaway path. airlock doctor is the only proof the hook or proxy is on. A gate that cannot prove it is on is not on. Linux, macOS, Windows. Python 3.11+. Also: curl -fsSL https://raw.githubusercontent.com/cyberbobas/airlock/main/install.sh | sh, or Homebrew brew tap cyberbobas/tap && brew install airlock.
Source: github.com/cyberbobas/airlock. Product page: agentoffense.com/solutions/airlock_ai.
How this maps to a pentest
A daily gate is not a pentest. A pentest is still how you find the path the control does not see. We sell both, and we will say so. If an agent in your shop can talk to customer data, payments or a production API, you want a human attacker on that boundary, then a retest after the fix. The report is the thing you take to a client or a regulator. The CLI is the thing your developers run on Tuesday.
Typical questions we get after a demo: “we already have a scanner”; “Anthropic will fix Claude”; “we could write this in a week”. A scanner is correct and incomplete. Anthropic will fix some of Claude Code; your fleet is mixed and you install the MCP servers yourselves. The first prototype of a gate passes its own tests and still has working bypasses (decoy arguments, JSON-RPC batch, pin overwrite, tools on page two of tools/list, a race between list and call). Writing a gate is a week. Making it hard to walk around is not a week. We wrote that down in the threat model on purpose.
FAQ
Is Airlock a runtime firewall for AI coding agents or just a scanner?
It is a runtime firewall. It intercepts the live tool or MCP call and answers allow, ask, or block. A scanner looks at text before install. Use both. Do not confuse them.
Does it stop prompt injection?
No. It gates the action the injection asks for. Anyone who tells you they “stop prompt injection” as a complete claim is selling intent-parsing. We sell the gate.
Which agents are covered today?
MCP traffic of Claude Code, Cursor, Windsurf, Cline, Codex, Kimi, grok, mimo and DeepSeek Harness. Claude Code also gets native Bash, Read and Write. The others’ built-in shells are on the roadmap, printed as “not yet”, not as a silent yes.
Does the local judge send code to a vendor?
No. The built-in judge is an offline llamafile. It can only tighten a decision. Skip it if you want. The rules still run.
How do I try it without touching production keys?
airlock demo on a spare account if you are pedantic. The demo itself does not read your secrets. Uninstall restores installer changes byte for byte.
Is this a subscription?
The local product on one machine is free open source. Fleet policy and an audit evidence pack are a separate conversation. We will not print an unconfirmed price here.
Does this replace an AI agent pentest?
No. The gate is daily hygiene. The pentest is how you find what the gate cannot see. Same team, different deliverable. Start with the demo, then scope a test if the agent can reach anything you would hate to lose.
Will it fight with our WAF or EDR?
It does not sit on HTTP. It sits on the agent’s tool calls. Complementary, not a replacement for perimeter controls.
If you want the short version: your AI coding agents already have your best engineer’s privileges. Airlock is the firewall between the agent and the machine. Install the demo. Read the limits. Then decide whether you want a policy, a pentest, or both.