airlock_ai

// the problem

You can’t read every action an agent takes — so it acts with your full privileges, on trust

A coding agent decides for itself what to do: reads files, runs shell, fetches URLs, calls MCP servers you never reviewed. It reads a tool’s description as an instruction. Five things go wrong — today, not in theory:

// this already happened

// how it works

Two enforcement points. One policy. One tamper-evident log.

Static scanners check a skill once, before install. airlock_ai sits in the call path and decides this call, right now — which is where a skill that reads clean and behaves badly actually gets stopped. It’s vendor-neutral: the airlock-mcp proxy gates the MCP traffic of every agent — Claude Code, Cursor, Windsurf, Cline, Codex, Kimi and anything else that speaks MCP. Claude Code additionally gets a second gate on its own built-in Bash/Read/Write tools. Same policy, same log, both paths.

// the decision

Every gated call runs the same pipeline — and every stage can only make it stricter

This is what separates a gate from a suggestion. One call, one deterministic path, no stage able to loosen an earlier refusal.

1. Admission. Is this server held? A server whose toolset changed since it was pinned, or whose descriptions scanned as poisoned, has every call refused until a human approves it.
2. Absolute blocks. The primary resource — and every other string in the arguments, nested ones included — is matched against the block rules. A secret path hidden in the fortieth argument blocks the call just as surely as one in file_path. Strings are normalised first (NFKC, percent-decoded to a fixpoint), so %25252essh and ．ssh are the same path as .ssh.
3. Reviewed grants. Exceptions a human added with airlock allow. A grant can never lift an absolute block.
4. Rules, then default. The rule list, first match wins, then the profile’s default posture.
5. Contract & project overlay. The per-skill contract and any policy the repository ships — consulted for every decision, and only ever to make it stricter.
6. Posture. The profile decides what happens to the unmatched middle and to an ask that reaches nobody. Then the verdict is enforced, recorded, and — if refused — you’re told what was stopped and the one command that would permit it.

That monotonicity isn’t a convention — it’s tested as a law over generated inputs: an extra argument can tighten a decision, never loosen it.

// why airlock_ai

What a scanner and a network gateway can’t do

// supply chain

The code your agent loads is code nobody reviewed

Skills and MCP servers install with one line, the way npm packages do — and the agent reads their tool descriptions as instructions. airlock_ai treats admission as a security decision, not a formality.

• Pins & rug-pull. On first sight, a server’s toolset is hashed and pinned. A later change holds every call to it until a human approves.
• Poisoning scan at admission. A description that overrides the agent’s instructions, names a credential path, carries an exfiltration verb, or asks to stay hidden holds the whole toolset on first sight.
• Batch scan before you install. airlock scan statically inspects SKILL.md, MCP configs, hook commands and the scripts a skill ships — scoring by where a finding sits, naming files it couldn’t read, and flagging which MCP servers are not behind the gate.
• Signed indicator feed. Collector hosts and injection phrasings rot like antivirus signatures, so they update — but a feed can only add or raise, never remove or weaken a built-in, and a pattern that could stall the gate is refused at install.

// what it does — and does not — cover

We publish our own limits. A firewall you can’t trust the boundaries of isn’t one.

Read the first two rows together: every agent’s MCP traffic is gated identically — Cursor, Windsurf, Cline and Codex included. Claude Code just gets an additional gate on its own built-in tools. airlock_ai is vendor-neutral, not Claude-only.

Injection can’t be scanned out of natural language — that’s architecture, not a temporary gap. The point isn’t to stop the agent being fooled; it’s to put a control between “the agent was fooled” and “the key left the building.”

// compliance

A tamper-evident record for the auditor — EU AI Act, Article 12

Since 2 August 2026, Article 12 requires high-risk AI systems to keep automatic, tamper-evident logs with traceability — capturing the events that matter for risk assessment, not just the final output. Penalties reach €15M or 3% of global turnover.

• Hash-chained JSONL log where editing any past line breaks every digest after it.
• airlock verify walks the whole structure and names the exact broken line.
• Ed25519 signing with the key held where the agent can’t read it — evidence becomes proof.
• Export to CEF (ArcSight / Splunk) and RFC5424 syslog, escaped so a crafted path can’t forge SIEM fields.
• Maps cleanly to ISO 42001, NIST AI RMF and SOC 2 CC7.

In testing, airlock verify detects editing any chained field, deleting a single record, reordering two, truncating anywhere, grafting a record from another log, deleting a whole segment, pruning the rotation ledger, removing a checkpoint, stripping a signature, and flipping any single byte. The chain continues across log rotations, and the log records the gate itself — a run under a substituted policy reads as a substitution, not as a quiet stretch of ordinary allows. Honest framing, stated in the docs: the chain is evidence; a key the agent cannot read is what makes it proof.

// it stays out of the way

A firewall that gets in the way on day one is the one you uninstall on day two

So airlock_ai is built to disappear into the background. Week one runs in yolo — nothing blocked, everything learned. default then blocks only the unambiguously dangerous and logs the rest. When it does stop something, you get a desktop notification saying what and why, the agent gets a refusal it can read, and one command permits it:

Grants are held to laws that are tested as laws: adding one never tightens anything else, adding it twice is adding it once, order never matters, an expired grant is exactly no grant, and no grant can lift an absolute block. airlock allow revoke is its exact inverse.

// overhead, measured

The gate is not where your agent spends its time

Sustained: 50,000 gated calls at ~1,200/s across 45 log rotations, memory flat to within 32 KB, no descriptor growth — reproduce it yourself with airlock bench. For scale: one model turn is hundreds of milliseconds at best. A sub-millisecond gate is not what your agent is waiting on.

// built to be trusted

A security tool is only as good as how hard it was attacked

// pricing

Free for people. Paid for fleets.

The whole local product is free and open-source, forever. Organisations pay for what a company — not a developer — needs: managing many machines and proving it to an auditor.

// further reading

Guides from our work on agent security

Put a firewall between your agents and your machine.

Works with every MCP agent · Linux / macOS / Windows · runs locally · open-source (Apache-2.0).