agent-interlock

Agent Interlock is a Python 3.11 framework (Apache-2.0) that applies the safety-engineering idea of an interlock to agent-to-agent interaction. Actors are declared in ActorSpec manifests, each actor's surface is wrapped with an SDK or proxy, and communication between them is observed, adjudicated and blocked so that only declared links may connect. The project centres on an MCP tool gateway. Threats M1 to M9 - tool poisoning, rug pull, tool shadowing, poisoned tool publish, confused deputy or token passthrough, MCP server to host compromise, agent-config discovery or modification, credential harvesting and data exfiltration - are handled at the data-flow level, each with default verdicts such as QUARANTINE, BLOCK, HOLD, CHALLENGE or SANITIZE. Enforcement is promoted in stages from OBSERVE through SHADOW to ENFORCE, and promotion to ENFORCE requires two signed approvals. A single Check table of 29 checks sits behind three enforcement points, each selecting its own profile: MCP gateway 21 checks, SDK 19, A2A broker 17. The README states plainly that the mechanism is shared but the coverage is not, and that the broker has no egress, volume or taint control. Components include the SDK (define_actor, connect, wrap), a runtime that intercepts inter-actor communication, an orchestrator that executes verified task DAGs over A2A, MCP and human transports, an A2A broker handling agent cards and tasks with pre-enforcement, an append-only ledger that records request, verdict, action and outcome events separately, graph views for design, runtime and attack paths, a box-based Studio web UI for architecture editing and manifest export, an Anthropic Tool Runner adapter, and an interlock verify command that runs nine L1 scenarios against a project's own guarded tools rather than the framework's fixtures. Other evidenced areas include MCP JSON-RPC tools/list, tools/call and list-changed enforcement bound to architecture digests; a Streamable HTTP JSON/SSE client with session binding; MCP OAuth discovery, PKCE S256, RFC 7662 introspection, optional JWKS/JWT verification and loopback consent; a stdio JSONL client with artifact pinning, signed sandbox attestation and Bubblewrap launch plans; signed provenance admission for publishers; per-destination egress guards compiled from architecture manifests; PostgreSQL partitioning, session_user-based FORCE RLS and an append-only ledger adapter with event and trace HTTP APIs; OTLP/HTTP JSON ingest; signed audit sinks; design-versus-runtime drift reconciliation for multi-agent edges; directional internal/external trust boundaries; and a fake-data end-to-end scenario suite with deterministic fixtures using .invalid addresses. The reference core has no external runtime dependencies, with PostgreSQL and Anthropic integrations as optional extras. The README is candid about what is not shipped: no LangGraph or Claude Agent SDK adapter, no sidecar proxy, server-side MCP connector interception left out of scope because those tools execute on the provider's side, an acceptance evaluator that is structural only, and a manifest parser that still drops some fields and side-effect actions. It also records that the SDK cannot reach the gateway's approval API, so an external write from a wrapped tool fails closed instead of being approvable from the SDK. Genuine external-integration work such as Sigstore, KMS/HSM, identity providers, real egress sidecars, TLS and distributed rate limiting is listed as remaining.