Tool Access Is Authority
An agent that can call a tool can cross trust boundaries: read a secret, write outside a workspace, reach cloud metadata, or invoke a destructive operation without meaningful approval.
mcpinterlock validates JSON-RPC tool calls against an explicit policy: allowlisted tools, destructive approvals, path roots, HTTPS and network-target rules, plus secret-shaped argument checks.
Deny With Evidence
Every decision includes stable violation codes and field paths and can be written to SQLite for later review. The same policy engine powers the CLI, API, local workbench, tests, and container.
The Demo
A seemingly ordinary fetch request is denied for two independent reasons: it uses an unsafe network target and writes outside the configured workspace root. Both failures are returned in one check.
The firewall mediates calls presented to it. Production isolation still needs operating-system permissions, network controls, authenticated approval channels, and careful server implementation.
Security Basis
The policy maps directly to MCP security guidance around confused-deputy risks, SSRF, least privilege, local-server compromise, and explicit user consent.
Read the MCP security best practices.