Quickstart

This gets Airlock in front of Claude Code with a small but real config.

Install

npm install -g airlock-bot

Create a minimal config

providers:
  github:
    type: stdio
    command: npx
    args: ['-y', '@modelcontextprotocol/server-github']
    env:
      GITHUB_PERSONAL_ACCESS_TOKEN: '${GITHUB_TOKEN}'

  exec: builtin
  http: builtin

agents:
  claude-code:
    allow:
      - 'github/list*'
      - 'github/get*'
      - 'http/get'
    ask:
      - 'github/create_pr'
    deny:
      - 'exec/run'

approvals:
  provider:
    type: stdio
  timeout_ms: 300000

Run Airlock in stdio mode

airlock --agent claude-code --config airlock.yaml

Wire Claude Code to Airlock

{
  "mcpServers": {
    "airlock": {
      "command": "airlock",
      "args": ["--agent", "claude-code", "--config", "/absolute/path/to/airlock.yaml"]
    }
  }
}

Next steps

• discover a CLI into named tools: CLI Discovery Wizard
• add more nuanced policy: Permissions
• add safe sandboxed execution variants: Sandboxed Python Variants