Airlock: MCP elicitation as a permission system for agent shell commands
Any agent (Claude Code, Cursor, VS Code, Zed) runs shell commands through one MCP server. Each command is checked before it runs: - Asked in your own client. A risky command returns an MCP elicitation form, which you answer with once, this session, always for this project or refuse. The MCP bundle signs the request state, and Airlock ties it to that exact command with a one-use token. An answer for `make test` can't be reused to run anything else. - Read like a shell would. A grant for `make test` doesn't cover `make test; rm -rf ~`. `sudo`, recursive deletes, `git push` and `curl | sh` are always asked. - Run in a sandbox (bubblewrap on Linux, sandbox-exec on macOS). Commands can write only inside the project and can't read your keys. The network reaches package registries and the hosts you allow. - Output checked by a model through `symfony/ai-platform`, using structured output (`clean` or `injection`). Secrets in the output are masked, and every command goes into one audit log. Built on `symfony/mcp-bundle` (`mcp/sdk`), `symfony/ai-platform` and `ai-bundle`. It installs with one command and has a working demo in five minutes.
Play the video on YouTube
1:30