Know when an approved MCP tool changes.

Interlock baselines the approved tool boundary, detects material capability or observed behavioral drift, quarantines the changed gateway-mediated call, and records hash-chained evidence.

MCP runtime trust layer for AI agents. Open source. Self-hosted. Designed for gateway-mediated MCP traffic.
1 · APPROVED BOUNDARY✓ approved
read-only tool · internal access
expected capability: read
expected result: denied / 403
baseline hash pinned · policy approved
2 · BEHAVIOR CHANGEDchanged
expected 403 → observed 200
manifest surface: unchanged
behavioral drift detected
3 · QUARANTINEDquarantined
decision: quarantined
changed gateway-mediated call not forwarded
reason: behavioral scope drift
4 · EVIDENCE VERIFIED✓ verified
hash-chained receipt
previous hash → current hash
verified offline
chain: verified
Gateway-mediated decisions are recorded in a hash-chained audit log, from which receipts can be verified offline. offline proof fixture
THE PROBLEM

Approval is only a snapshot.

An MCP tool may be approved with a specific capability, externality, permission boundary, and expected behavior. Later, its schema, underlying API, authorization behavior, deployment, or effective capability may change. Static allowlists and one-time approval do not prove that the same runtime boundary still exists.

SURFACE DRIFT
Tool names, parameters, schemas, or declared capabilities change.
CAPABILITY DRIFT
A tool gains broader effects, externality, permissions, or data access.
OBSERVED BEHAVIORAL DRIFT
Runtime behavior changes while the manifest remains unchanged — expected 403 → observed 200. Invisible to schema diffing.
HOW IT WORKS

Gateway-mediated, baseline-compared.

Interlock sits in the call path, compares every later call against the boundary an operator approved, and records what it decided.

Interlock only governs calls routed through its gateway.
1Register a gateway-mediated MCP server
2Review and approve its tool boundary
3Create an approved baseline
4Compare later surface and behavioral evidence
5Detect material drift
6Quarantine the changed call
7Record the gateway decision
8Operator approves, rejects, or rebaselines
THE PRODUCT CONSOLE

Drift review comes first.

The first thing you see is the drift review queue: the approved baseline, expected-versus-observed evidence, the quarantine decision, forwarding status, and the receipt — with approve, reject, or rebaseline one action away.

Approved server and tool baseline, always visible
Expected-versus-observed evidence per decision
Receipt details and offline chain verification
Scan statistics, configuration, and administration remain available — they just aren't the story.
Drift review queueOffline proof fixture. Receipt chain verified.
TOOL BOUNDARYEXPECTEDOBSERVEDDECISION
read-only tool (fixture) denied / 403 allowed / 200 quarantined
EXPECTED VS OBSERVED
manifest surface: unchanged
classification: behavioral scope drift
forwarding: not forwarded
RECEIPT
previous hash → current hash
chain: verified · verifiable offline
Approve Reject Rebaseline Operator actions · shown for reference, one continuous example
EVIDENCE

See exactly what changed.

Schema drift shows up in the surface diff. Behavioral drift shows up only in observed evidence — same manifest, different runtime behavior.

APPROVED
expected result: denied / 403
manifest surface: unchanged
approved baseline
policy version recorded
OBSERVED
observed result: allowed / 200
manifest surface: unchanged
behavioral mismatch detected
evidence recorded
DECISION
classification: behavioral scope drift
decision: quarantined
call not forwarded
receipt recorded
OFFLINE PROOF

Run the proof locally.

You don't need a call to see it work. The proof runs on your machine, against a clearly labelled fixture.

Runs locally, using an offline proof fixture
Demonstrates expected 403 → observed 200
Shows the manifest surface unchanged throughout
Shows the quarantine decision and forwarding status
Produces receipt evidence for the decision
Supports offline receipt-chain verification
PUBLIC TECHNICAL FEEDBACK

Reviewed in the open.

What was tested, what passed, what failed, and what was corrected — linked to the original public discussion. This public feedback is not presented as customers, partners, testimonials, or endorsements.
spec · draft · in public review
MCP SEP #3004 — draft receipt specification
Proposed receipt semantics for the MCP spec process. Draft under review in an open PR; revisions are tracked there.
View the public draft ↗
merged · upstream
substack-mcp annotation fix
A review raised an annotation-default issue on the substack-mcp server; the fix was merged upstream by the maintainer.
View the merged pull request ↗
discussion · public
Maintainer discussions of drift detection
Public threads on where post-approval trust-checking belongs — on the substack-mcp and mailchimp-mcp-server repositories.
substack-mcp discussion ↗ mailchimp-mcp-server discussion ↗
HONEST LIMITS

What Interlock does not claim

Stated plainly, on the page — not in a footer or a tooltip.

Interlock only controls traffic routed through its gateway.
Direct access to an MCP server can bypass the gateway.
Surface drift can be detected before forwarding. Some behavioral drift requires a controlled probe or observed response — the first behavioral change may be discovered through the evidence that probe produces.
Hash-chained receipts are tamper-evident operational evidence. They are not externally signed or independently anchored.
Interlock does not support every MCP transport and extension.
Early evaluations should begin in non-production or shadow mode.
WHO IT'S FOR
AI PLATFORM TEAMS
Operating internal or customer-facing agents.
AGENT INFRASTRUCTURE
Managing changing MCP servers, gateways, and tool registries.
PLATFORM SECURITY
Reviewing permissions, externality, and data boundaries.
DEVSECOPS TEAMS
Governing consequential tool actions in the call path.
Relevant environments may include databases, CRM systems, GitHub, deployment infrastructure, internal APIs, customer records, and communication tools — not implied as current deployments.

Evaluate one MCP trust boundary.

Interlock is seeking technical conversations and controlled non-production evaluations with teams operating meaningful MCP tool boundaries.

choose one gateway-mediated server → select a few meaningful tools → record the approved boundary → run one controlled drift scenario → inspect the quarantine decision → verify the receipt chain → document findings and limitations
Or reach the founder directly: maaz@getinterlock.dev