Stateless governance proxy for MCP (2026-07-28): policy, dry-run, human confirmation, audit, tracing
mcp-airlock is a proxy you put between an AI agent and an MCP server when the server can do things you don't want an agent doing on its own. It speaks the 2026-07-28 revision of the protocol (the stateless one: no session, no initialize, one POST per request) and adds the parts the protocol leaves to you: who is allowed to call what, dry runs by default, a human in the loop for dangerous calls, an audit trail and tracing.
It is deliberately small. There is no UI, no policy language beyond flat YAML, no MCP SDK of its own. The whole proxy is one Starlette app plus a few helper modules.
The agent sends a normal tools/call to the proxy instead of the server. The proxy:
1. Works out who is calling. That comes from a JWT (Authorization: Bearer) or, if you run it behind a gateway that already did the authentication, from an X-Airlock-Principal header. It is never taken from the request body. No principal, no call. 2. Looks the tool up in the policy. Tools that are not listed are refused. Listed tools have a risk tier per environment, so the same deleteservice can be free in dev and gated in prod. 3. Depending on the tier: L0 (read) goes straight through. L1 (suggest) always goes through with dryrun: true, whatever the agent asked for. L2 (confirm) goes through with dryrun: true first, and the result comes back to the agent as inputrequired with a description of what would happen and a signed requestState. When a person says yes, the agent repeats the call with that state and the proxy executes it for real, once. Repeating it again is refused. L3 (auto) goes through as sent. 4.
From the project README.
Add the radar badge to your README — it shows your project was picked up by MCP Radar and links to this page:
[](https://mcp.liqiwa.com/s/Shalimov04--mcp-airlock.html)
The execution safety layer for AI agents.
batrapulkit/squidbrakeBrakes for your AI agents: every tool call is checked against your rules, held for human approval when risky, and recorded in a tamper-evident audit trail. Works with Claude Code and any MCP app.
carnet-mcp/carnetAn MCP tool. Connect your assistant to /mcp and every tool call goes through a broker — scoped per caller, under a credential they never hold, revocable, metered and audited.
agent-chaperone/agent-chaperoneScreens an AI agent's tool calls before they run and tool results before the agent reads them. An MCP proxy plus a hooks adapter for a client's built-in tools.
JUSICK/Argos-mcp-guardrailA lightweight, sub-millisecond security shim that prevents AI agents from accessing sensitive files (.env, SSH keys) and executing destructive commands via MCP.
neuronto/agentic-resource-discoveryNeuronto Agentic Resource Discovery (ARD) Index. Federated search across every public ARD registry, plus a verified tool index read from each MCP server's own tools/list, hybrid lexical and semantic r
The top new MCP servers of the week, every Monday. No spam, unsubscribe anytime.