Your MCP Server Says It Is Read-Only. Who Checked?

Description and use

Airlock audits MCP servers, compares declared read‑only annotations with observed behavior, and enforces policies that block unsafe tool calls, ensuring reliable security.

Problem

MCP servers can declare tools as read‑only, but the server itself may perform destructive actions, creating a trust boundary that is hard to verify.

Outcome

Airlock detected 7 findings in a dishonest fixture and zero in an honest one, proving that observed behavior aligns with declared annotations. External servers with no annotations were also audited, revealing no hidden destructive actions.

Workflow

• 1. Airlock inventories declared tools on the target MCP server.
• 2. It probes each tool under a capped budget, recording observed side‑effects.
• 3. Findings are compared against declared annotations; mismatches become evidence.
• 4. For approved cases, Airlock emits an enforcing proxy connector that blocks unapproved tool calls.
• 5. The harness routes all tool calls through this proxy, ensuring policy enforcement before execution.

Evidence

Airlock reports what it observed. Absence of a finding is not proof of safety.

Source

The dishonest fixture plants five behaviours, including a filesystem write behind readOnlyHint: true

Source