Tool Access Is Authority
An agent that can call a tool can cross trust boundaries: read a secret, write outside a workspace, reach cloud metadata, or invoke a destructive operation without meaningful approval.
mcpinterlock validates JSON-RPC tool calls against an explicit policy: allowlisted tools, destructive approvals, path roots, HTTPS and network-target rules, plus secret-shaped argument checks.
Deny With Evidence
Every decision includes stable violation codes and field paths and can be written to SQLite for later review. The same policy engine powers the CLI, API, local workbench, tests, and container.
The Demo
A seemingly ordinary fetch request is denied for two independent reasons: it uses an unsafe network target and writes outside the configured workspace root. Both failures are returned in one check.
The firewall mediates calls presented to it. Production isolation still needs operating-system permissions, network controls, authenticated approval channels, and careful server implementation.
Finding A Real Bypass In My Own SSRF Check
A firewall built specifically to stop SSRF against cloud metadata endpoints deserved a genuine attempt to break it, not just a demo that passes. The network check blocked a resolved address whenever Python's ipaddress module reported it as private, loopback, link-local, or reserved — four properties that sound exhaustive but aren't.
RFC 6598's carrier-grade-NAT shared address space, 100.64.0.0/10, is used internally by real cloud providers and is explicitly non-public per the RFC — but Python's ipaddress module doesn't classify it as private. Verified directly: a hostname resolving into that range sailed straight through the check as allowed. Multicast addresses had the same gap, uncovered by any of the four properties.
Fixed by switching to not is_global as the umbrella check — the actual inverse of "publicly routable unicast" — plus an explicit multicast check, since multicast addresses report is_global=True in Python's model and would otherwise slip through the inverse alone. Re-verified every previously-blocked target still gets blocked (the metadata endpoint, loopback, RFC 1918 space, 0.0.0.0, even an IPv4-mapped IPv6 form of the metadata address) while legitimate public targets still pass.
Security Basis
The policy maps directly to MCP security guidance around confused-deputy risks, SSRF, least privilege, local-server compromise, and explicit user consent.
Read the MCP security best practices.