Краткий обзор по-русски

mcp-airlock는 서버가 할 수 있을 때 AI 에이전트와 MCP 서버 사이에 넣어 프록시입니다. 자신의 대리인을 원하지 않는 것. 그것은 2026-07-28 개정을 말한다 프로토콜( stateless one: no session, no initialize], 요청당 하나의 POST) 및 추가 부품은 프로토콜이 당신에게 나타날 수 있습니다. 누구가 무엇을 호출 할 수 있는지, 기본적으로 드라이 실행, 위험한 통화, 감사 트레일 및 추적을위한 루프의 인간.

그것은 deliberately 작습니다. UI가 없습니다, 평면 YAML을 넘어 정책 언어 없음, MCP SDK 없음 그 자체. 전체 프록시는 하나의 Starlette 앱과 몇 가지 도움말 모듈입니다.

통화가 진행되는 방법

에이전트는 서버 대신 프록시에 정상 tools/call을 보냅니다. 프록시:

1. 전화를 걸고 있습니다. 즉 JWT (Authorization: Bearer) 또는 실행중인 경우 이미 인증받은 게이트웨이 뒤에 X-Airlock-Principal 머리. 그것은 요구 몸에서 결코 가지고 있지 않습니다. 전화 번호 이름은 공백이 있거나 주변의 whitespace가 없습니다. alice ] alice]이 될 것입니다.
2. 정책에서 도구를 찾습니다. 나열되지 않은 도구는 거부됩니다.

mcp-airlock

Краткий обзор по-русски

mcp-airlock is a proxy you put between an AI agent and an MCP server when the server can do things you don’t want an agent doing on its own. It speaks the 2026-07-28 revision of the protocol (the stateless one: no session, no initialize, one POST per request) and adds the parts the protocol leaves to you: who is allowed to call what, dry runs by default, a human in the loop for dangerous calls, an audit trail and tracing.

It is deliberately small. There is no UI, no policy language beyond flat YAML, no MCP SDK of its own. The whole proxy is one Starlette app plus a few helper modules.

How a call goes through

The agent sends a normal tools/call to the proxy instead of the server. The proxy:

1. Works out who is calling. That comes from a JWT (Authorization: Bearer) or, if you run it behind a gateway that already did the authentication, from an X-Airlock-Principal header. It is never taken from the request body. No principal, no call. A name that is blank or has whitespace around it is no principal either, from either source: trimmed, alice would be alice.
2. Looks the tool up in the policy. Tools that are not listed are refused. Listed tools have a risk tier per environment, so the same delete_service can be free in dev and gated in prod.
3. Depending on the tier:
   • L0 (read) goes straight through.
   • L1 (suggest) always goes through with dry_run: true, whatever the agent asked for.
   • L2 (confirm) goes through with dry_run: true first, and the result comes back to the agent as input_required with a description of what would happen and a signed requestState. When a person says yes, the agent repeats the call with that state and the proxy executes it for real, once. Repeating it again is refused.
   • L3 (auto) goes through as sent.
4. Checks the blast radius: how many objects one call touches (the length of a list argument you name in the policy) and how many a principal has touched in the last hour or day.
5. Forwards the call, cuts the response down to the output cap if it is too big, and marks anything in it that smells like a prompt injection. Marking only; it does not change what the agent gets to see.
6. Writes two audit records, one before the upstream call and one after, whatever happened. The JSONL file gets each one before the proxy goes on; the Postgres table, when there is one, is written from a queue a moment later.

Refusals come back as tool results with isError: true, not as protocol errors, so the model sees why and can do something else. Every tools/call result, a pending one included,