NestDaddy

mcp-airlock

io.github.Shalimov04/mcp-airlock · v0.2.0

Governance proxy for MCP servers: allowlist, forced dry run, human confirmation, blast radius, audit

Connect Runs on your machine

Terminal
claude mcp add mcp-airlock -e AIRLOCK_JWT_SECRET=<AIRLOCK_JWT_SECRET> -e AIRLOCK_SECRET=<AIRLOCK_SECRET> -- uvx mcp-airlock==0.2.0
claude_desktop_config.json
{
  "mcpServers": {
    "mcp-airlock": {
      "command": "uvx",
      "args": [
        "mcp-airlock==0.2.0"
      ],
      "env": {
        "AIRLOCK_JWT_SECRET": "<AIRLOCK_JWT_SECRET>",
        "AIRLOCK_SECRET": "<AIRLOCK_SECRET>"
      }
    }
  }
}
~/.cursor/mcp.json
{
  "mcpServers": {
    "mcp-airlock": {
      "command": "uvx",
      "args": [
        "mcp-airlock==0.2.0"
      ],
      "env": {
        "AIRLOCK_JWT_SECRET": "<AIRLOCK_JWT_SECRET>",
        "AIRLOCK_SECRET": "<AIRLOCK_SECRET>"
      }
    }
  }
}
.vscode/mcp.json
{
  "servers": {
    "mcp-airlock": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "mcp-airlock==0.2.0"
      ],
      "env": {
        "AIRLOCK_JWT_SECRET": "<AIRLOCK_JWT_SECRET>",
        "AIRLOCK_SECRET": "<AIRLOCK_SECRET>"
      }
    }
  }
}

Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.

Tools

This server runs locally, so its tools are listed by your MCP client once it starts.

Environment variables

NameDescription
AIRLOCK_JWT_SECRET
Optional, secret
HS256 secret for verifying bearer tokens (or set AIRLOCK_JWKS_URL for OIDC)
AIRLOCK_SECRET
Optional, secret
Key for signing confirmation tokens; set it when running more than one replica

Details

Package[email protected] (PYPI, streamable-http)
First published16 Sep 2026
Last updated16 Sep 2026
Registry nameio.github.Shalimov04/mcp-airlock

More other servers See all

Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.