By airlockapp
Airlock security gateway for Claude Code — gates tool use through mobile approval. Sign in and pair via plugin commands; no need to run the daemon CLI directly for auth.
Add an auto-approve pattern. Shell commands matching any pattern bypass gateway approval.
Disable Airlock enforcement. All tool use will be allowed without gateway approval.
Enable Airlock enforcement. All tool use will be gated through the gateway. This is the default.
Run this when the user invokes **/airlock:dev-mode** to use a local gateway with self-signed certificates.
Remove an auto-approve pattern from the current workspace.
Matches all tools
Hooks run on every tool call, not just specific ones
Own this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimOwn this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimBased on adoption, maintenance, documentation, and repository signals. Not a security audit or endorsement.
IDE enforcer extensions and CLI for Airlock — the cryptographically enforced approval gateway for AI agents.
These extensions intercept AI agent actions before execution and route them through a mobile approval flow, ensuring no sensitive or high-impact action runs without an explicitly signed human decision.
Airlock Approver (mobile app): App Store · Google Play
Airlock implements HARP — the Human Authorization & Review Protocol — a standards-grade, cryptographically verifiable authorization layer for AI agents.
This repository includes a HARP specification draft suite (v0.2) under samples/harp/:
| Area | Location | Description |
|---|---|---|
| Core | samples/harp/src/spec/core/ | Artifact canonicalization, hashing, decision signing, replay protection |
| Gateway | samples/harp/src/spec/gateway/ | HTTP binding, artifact submit, decision wait, schemas |
| Prompt / Session | samples/harp/src/spec/prompt/, session/ | Prompt and session message types |
| Infrastructure | samples/harp/src/spec/infrastructure/ | KEYMGMT, THREATMODEL, TRANSPORT, COMPLIANCE |
| Governance | samples/harp/src/spec/governance/ | Governance and lifecycle |
Enforcers and the CLI align with HARP-CORE (artifact hash, decision verification, E2E encryption), the Gateway HTTP binding, and HARP key/encryption practices. See samples/harp/src/spec/README.md for the full spec layout.
| Extension | IDE | Interception Method |
|---|---|---|
| Airlock Cursor Enforcer | Cursor | Hooks (pre-tool-use gate) |
| Airlock Windsurf Enforcer | Windsurf | Hooks (pre-tool-use gate) |
| Airlock Copilot Enforcer | VS Code (GitHub Copilot) | Hooks (pre-tool-use gate) |
| Airlock Antigravity Enforcer | VS Code (Google Antigravity) | CDP (Chrome DevTools Protocol) |
| Airlock CLI | Any shell | CLI (sign-in, pair, approve) — use with shell plugins (Bash, Zsh, PowerShell) |
All enforcers provide:
The Claude Code enforcer plugin is included in this repository:
👉 Claude Code Enforcer — install via /plugin marketplace add airlockapp/extensions
npx claudepluginhub airlockapp/extensions --plugin airlockAPort Agent Guardrails — security policy enforcement for every tool call. Intercepts tool use, evaluates against your passport policy, and blocks unauthorized actions.
Achieve flow state safely with Claude Code. Auto-approves routine work, gates risky actions, hard-blocks dangerous patterns. Dual enforcement (skill + hooks), token cap for cost governance, full audit trail. Zero dependencies.
A secure runtime for Claude Code. Intercepts every tool call with policy-based allow/block/ask decisions, evasion detection, path fencing, file snapshots, and audit logging.
AGT governance hooks and MCP tools for Claude Code sessions
Runtime security for AI agents. Blocks destructive actions before execution, routes high-risk operations through human approval, and maintains an immutable audit trail. Covers OWASP MCP Top 10, ASI Top 10, and Agentic Skills Top 10.
Command Line Agent Safety Harness. All interactions with clash policy should go through this plugin