Claude Code and Cursor are now standard on most engineering teams. They’re also the most privileged process on the machine most of the day. This is a practical guide to keeping them useful without handing them the keys to everything.
Start by naming the risk
Both agents can read and write files, run shell commands, reach the network and call connected MCP servers — with your privileges. The failure modes are the same across agents: a poisoned tool, a destructive command from an ambiguous task, a credential read-and-send, and no record afterward. Read what an AI coding agent can actually do for the full surface.
1. Run week one in observe mode
Before you block anything, learn what your agents actually do. A firewall that gets in the way on day one is the one you uninstall on day two. Start in an observe posture that blocks nothing and records everything, then tighten from evidence rather than guesswork.
2. Apply least privilege
- Don’t run agents as an account that also holds production credentials and long-lived cloud keys.
- Scope each connected tool to what it needs — a date formatter shouldn’t reach the filesystem or the network.
- Keep secrets out of the working directory the agent roams.
3. Gate the dangerous, unambiguously
Some actions should always stop and ask a human: writes to ~/.ssh, reads of cloud metadata endpoints, curl | sh, force-pushes, destructive database commands. These are cheap to block and catch both mistakes and attacks. The key is that the gate sits in the call path — deciding this call, right now — not in a scan that ran once before install.
4. Audit your MCP servers
- Inventory every MCP server your team has connected. Most teams can’t produce this list — that’s the problem.
- Pin each server’s toolset and hold calls if it changes silently (the rug-pull defence).
- Scan tool descriptions for hidden instructions before you trust them.
5. Keep a tamper-evident record
When something goes wrong, you need to answer “what did the agent do?” with a log, not a shrug. A hash-chained, append-only record — where editing any past line breaks every digest after it — turns an incident into an investigation, and increasingly satisfies compliance too (see EU AI Act Article 12).
A note on mixed fleets
Most teams run more than one agent. The important thing: every agent’s MCP traffic can be gated the same way, vendor-neutrally, because MCP is a protocol boundary. Claude Code can additionally gate its own built-in file and shell tools via a hook. Cursor, Windsurf and Cline have their MCP gated today; their own built-in tools are a roadmap item — worth knowing before you assume full coverage.
Doing it in practice
You can assemble the pieces above yourself, or use a tool built for exactly this: airlock_ai is a runtime firewall that gates every tool call and MCP call against a least-privilege policy, pins and holds servers on change, scans descriptions at admission, and writes a tamper-evident log — across Claude Code, Cursor, Windsurf, Cline and Codex. If you’d rather have an attacker pressure-test your setup first, that’s our AI agent penetration testing.
Frequently asked questions
Will gating slow my developers down? A well-built gate adds well under a millisecond per call — one model turn is hundreds of milliseconds. The friction is in over-blocking, which is why observe-first matters.
Is Cursor less secure than Claude Code? Their MCP surfaces are gated identically. Claude Code just has an extra gate on its native tools today.
Ready to put a boundary around your agents? See airlock_ai or request an agent security assessment.