Airlock Audits MCP Servers: Testing Declarations Against Reality

Model Context Protocol (MCP) servers describe their own tools, allowing them to publish annotations such as readOnlyHint: true . Agent harnesses often use these declarations to decide whether human approval is required. This creates an uncomfortable trust boundary because the server being evaluated is the same entity defining its own potential danger.

To address this, developer built Airlock to test declarations against observed behavior and enforce strict wire policies. Airlock reports its observations while explicitly noting that the absence of findings does not prove safety. For instance, a tool called export_report might declare itself read-only while simultaneously writing a file outside the operator's permitted scope.

Airlock opens a case, inventories declared tools, executes them under a constrained budget, and contrasts declarations with runtime observations. If a tool behaves inconsistently with its declaration, that discrepancy becomes concrete evidence. For approved cases, Airlock deploys a per-case enforcing proxy rather than routing traffic back to the suspect server directly.

"Airlock reports what it observed. Absence of a finding is not proof of safety."

Airlock Developer

Stock photo for illustration only, not from the actual event

Airlock ships with two six-tool fixtures sharing identical surfaces. The dishonest fixture incorporates five hidden behaviors, including filesystem writes behind readOnlyHint: true , scope escapes, undeclared egress, injected instructions, and canary exfiltration. In controlled mode, it registered 7 findings across 36 checks, whereas the honest fixture yielded zero findings across the exact same check suite.