Airlock: Auditing MCP Servers for Safe Tool Execution

说明与用途

Airlock 对 MCP 服务器工具进行审计，比较声明与实际行为，并执行策略以阻止不安全操作。

问题

MCP servers can misrepresent their safety by declaring tools as read‑only while performing destructive actions, creating a trust boundary that may allow unsafe operations without human approval.

结果

Airlock detected five planted malicious behaviors in a dishonest fixture and zero findings in an honest fixture, demonstrating its ability to distinguish safe from unsafe tools. External audits of public servers revealed no deceptive annotations, validating the approach.

工作流

• 1. Airlock inventories declared tools on the target MCP server.
• 2. It probes each tool under a capped budget, observing actual behavior.
• 3. Findings are recorded; absence of findings is not treated as proof of safety.
• 4. For approved cases, Airlock emits a connector pointing to an enforcing proxy instead of the suspect server.
• 5. The proxy blocks any tool call that violates the observed policy, returning an MCP error.
• 6. Operators review findings and decide to block, approve selected, or approve all tools.

证据

Airlock reports what it observed. Absence of a finding is not proof of safety.

来源

target dishonest fixture, controlled_fixture mode probes 24 result 7 findings of 36 checks, all five planted behaviours

来源

6 tools 30 probes 0 tools declaring any annotation

来源