Airlock — Pre-execution Security Gateway for AI Agents

How Airlock Protects Agent Tool Invocations

Rather than trusting LLMs to judge other LLMs, Airlock enforces a mathematically verifiable 3-step gating pipeline.

Stub Discovery & Script Synthesis

Agents discover tools via compact TypeScript interfaces (search_tools) rather than ingesting 50+ monolithic JSON schemas. The agent generates a single-shot execution plan script.

✓ 94.7% token reduction

Deterministic AST Inspection

Before execution, Airlock compiles the script into an AST. It statically inspects all tool invocations, loop mutations, prototype traversals, and semantic data-flow classifications in under 2ms.

✓ Precedence: DENY > HOLD > ALLOW

Hardened Sandboxed Worker Isolation

Safe scripts execute single-shot inside isolated sandboxed workers with strict memory and CPU caps. Flagged operations (such as untrusted email reads writing to external webhooks) pause for 1-click human approval.

✓ Air-gapped process boundary

Attack Vectors Neutralized Before Execution

View Integration Specs→

reads untrusted → writes external

Prompt Injection Exfiltration

Stops untrusted data inside emails, web pages, or customer tickets from instructing agents to exfiltrate database records to external webhooks.

destructive action held

Destructive System Mutations

Holds schema drops, table truncations, cloud VM deletions, and production restarts for single-click human operator authorization.

anti_analysis_denied

Prototype & VM Escapes

Deterministic AST inspection blocks __proto__, constructor traversal, eval(), dynamic imports, and process environment variable theft.

write_loop_budget_exceeded

Runaway Mutation Loops

Detects state mutations and external calls embedded inside unbound loops, enforcing strict per-script call budgets and rate limits.

credential_probing_blocked

Secret & Key Harvesting

Air-gapped execution proxy prevents scripts from reading environment secrets, API tokens, or host process memory.

dynamic_dispatch_rejected

Tools Object Spoofing

Prevents aliasing or destructuring tools objects to hide sensitive operations from static data-flow classification.

Multi-Turn Tool Calling vs Airlock Script Mode

Evaluation Dimension	Traditional Multi-Turn MCP	Airlock Pre-Execution Mode
Context Token Load (50 tools)	7,858 tokens / turn (re-ingested)	412 tokens / task (94.7% reduction)
Prompt Injection Defense	None (Blind tool execution)	100% intercepted by data-flow policy
Inspection Mechanism	Post-execution logging / LLM guardrail	Pre-execution deterministic AST gating
Human Operator Approvals	Manual interrupts / unstandardized	Centralized queue with 1-click approvals
Execution Isolation	Host process environment	Hardened Isolated Worker Sandbox
Analysis Latency Overhead	800ms - 2,500ms (LLM judge roundtrip)	1.26ms p95 (deterministic compiler)

Agent Tools

Connect your AI tools in seconds by adding the Airlock MCP gateway endpoint.

Cursor IDE

.cursor/mcp.json

{
  "mcpServers": {
    "airlock": {
      "url": "https://gateway.airlock.dev/mcp",
      "headers": {
        "Authorization": "Bearer alk_live_YOUR_KEY"
      }
    }
  }
}

Claude Desktop

claude_desktop_config.json

{
  "mcpServers": {
    "airlock": {
      "command": "npx",
      "args": ["-y", "@airlock/mcp-client", "--gateway", "https://gateway.airlock.dev/mcp"]
    }
  }
}

AIRLOCK*