Airlock: Auditing MCP Servers for Safe Tool Execution

Description and use

Airlock audits MCP server tools, compares behavior to declarations, and enforces policies to block unsafe operations.

Problem

MCP servers can misrepresent their safety by declaring tools as read‑only while performing destructive actions, creating a trust boundary that may allow unsafe operations without human approval.

Outcome

Airlock detected five planted malicious behaviors in a dishonest fixture and zero findings in an honest fixture, demonstrating its ability to distinguish safe from unsafe tools. External audits of public servers revealed no deceptive annotations, validating the approach.

Workflow

• 1. Airlock inventories declared tools on the target MCP server.
• 2. It probes each tool under a capped budget, observing actual behavior.
• 3. Findings are recorded; absence of findings is not treated as proof of safety.
• 4. For approved cases, Airlock emits a connector pointing to an enforcing proxy instead of the suspect server.
• 5. The proxy blocks any tool call that violates the observed policy, returning an MCP error.
• 6. Operators review findings and decide to block, approve selected, or approve all tools.

Evidence

Airlock reports what it observed. Absence of a finding is not proof of safety.

Source

target dishonest fixture, controlled_fixture mode probes 24 result 7 findings of 36 checks, all five planted behaviours

Source

6 tools 30 probes 0 tools declaring any annotation

Source