Airlock: Auditing MCP Servers for Safe Tool Execution

Описание и применение

Airlock проверяет поведение инструментов MCP‑серверов, сравнивая их с декларациями, и применяет политику, блокируя небезопасные операции.

Задача

MCP servers can misrepresent their safety by declaring tools as read‑only while performing destructive actions, creating a trust boundary that may allow unsafe operations without human approval.

Результат

Airlock detected five planted malicious behaviors in a dishonest fixture and zero findings in an honest fixture, demonstrating its ability to distinguish safe from unsafe tools. External audits of public servers revealed no deceptive annotations, validating the approach.

Рабочий процесс

• 1. Airlock inventories declared tools on the target MCP server.
• 2. It probes each tool under a capped budget, observing actual behavior.
• 3. Findings are recorded; absence of findings is not treated as proof of safety.
• 4. For approved cases, Airlock emits a connector pointing to an enforcing proxy instead of the suspect server.
• 5. The proxy blocks any tool call that violates the observed policy, returning an MCP error.
• 6. Operators review findings and decide to block, approve selected, or approve all tools.

Доказательства

Airlock reports what it observed. Absence of a finding is not proof of safety.

Источник

target dishonest fixture, controlled_fixture mode probes 24 result 7 findings of 36 checks, all five planted behaviours

Источник

6 tools 30 probes 0 tools declaring any annotation

Источник