{\fn黑体\fs22\bord1\shad0\3aHBE\4aH00\fscx67\fscy66\2cHFFFFFF\3cH808080}你觉得呢?

mcp-airlock是服务器可以时您在 AI 代理服务器和 MCP 服务器之间设置的代理服务器 你不希望经纪人自己干的事 它讲的是2026-07-28 协议(无国籍人协议:无会话、无initialize、每件请求一个POST)并添加 协议留给你的部分: 谁被允许调用什么, 干运行默认, 一个危险电话、审计线索和追踪的人

这是故意小。 没有UI,没有政策语言 除了平面YAML,没有MCP SDK 自己来的 整个代理是一款Starlette app外加几个帮助模块.

□ 一个电话是如何通过

代理发送一个普通 tools/call 到代理服务器而不是服务器 。 代理服务器 :

1. 确定谁打电话。 这来自JWT([[T2]),或者,如果你运行 从一个[T3] 已经进行认证的网关后面 头曰. 它从来没有从请求机构取出。 没有校长,没有电话。 这个名字 空白或周围的空地 也不是主要来源: 修剪后, [[T4]将是[T5]。
2. 在政策中寻找工具。 未列出的工具被拒绝.

mcp-airlock

Краткий обзор по-русски

mcp-airlock is a proxy you put between an AI agent and an MCP server when the server can do things you don’t want an agent doing on its own. It speaks the 2026-07-28 revision of the protocol (the stateless one: no session, no initialize, one POST per request) and adds the parts the protocol leaves to you: who is allowed to call what, dry runs by default, a human in the loop for dangerous calls, an audit trail and tracing.

It is deliberately small. There is no UI, no policy language beyond flat YAML, no MCP SDK of its own. The whole proxy is one Starlette app plus a few helper modules.

How a call goes through

The agent sends a normal tools/call to the proxy instead of the server. The proxy:

1. Works out who is calling. That comes from a JWT (Authorization: Bearer) or, if you run it behind a gateway that already did the authentication, from an X-Airlock-Principal header. It is never taken from the request body. No principal, no call. A name that is blank or has whitespace around it is no principal either, from either source: trimmed, alice would be alice.
2. Looks the tool up in the policy. Tools that are not listed are refused. Listed tools have a risk tier per environment, so the same delete_service can be free in dev and gated in prod.
3. Depending on the tier:
   • L0 (read) goes straight through.
   • L1 (suggest) always goes through with dry_run: true, whatever the agent asked for.
   • L2 (confirm) goes through with dry_run: true first, and the result comes back to the agent as input_required with a description of what would happen and a signed requestState. When a person says yes, the agent repeats the call with that state and the proxy executes it for real, once. Repeating it again is refused.
   • L3 (auto) goes through as sent.
4. Checks the blast radius: how many objects one call touches (the length of a list argument you name in the policy) and how many a principal has touched in the last hour or day.
5. Forwards the call, cuts the response down to the output cap if it is too big, and marks anything in it that smells like a prompt injection. Marking only; it does not change what the agent gets to see.
6. Writes two audit records, one before the upstream call and one after, whatever happened. The JSONL file gets each one before the proxy goes on; the Postgres table, when there is one, is written from a queue a moment later.

Refusals come back as tool results with isError: true, not as protocol errors, so the model sees why and can do something else. Every tools/call result, a pending one included,