Your agents can already reach money, data, and production. Interlok finds those paths, locks the risky ones, and proves every decision.
Interlok scans your agent setup: MCP servers, tools, and the credentials behind them. It maps every path from an agent to something consequential.
Each path is scored on three things:
You get: a map of agent → tool → business process, with every ungated write path flagged.
Route tool calls through the Interlok proxy. Each call is checked against policy in real time.
We gate actions, not agents. Reads, searches, and routine work pass through untouched. Only high-impact actions stop: moving money, writing to production, deleting data, changing permissions.
Not sure what to lock? Run in shadow mode first. See what would be held, tune your policy, then enforce.
A held action waits for a human. Approve or deny in Slack or the console, with your identity verified through your identity provider.
An agent can never approve an agent.
Every decision is signed and hash-chained into a tamper-evident ledger, using keys you hold.
Export evidence for auditors or customer security reviews, and verify it offline without us. It also streams to your SIEM.
Every Shadow run and Gate decision produces a signed receipt you can verify offline.
From sign-in to a bundle your auditor, your customer or a prime can verify. Steps 3 and 4 need Gate; with Evidence Connect alone, the evidence comes from the gateway you already run.
GET /api/v1/attestations/{id}/bundle. The recipient runs interlok verify with no account. Proof Export (.ilproof) bundles also verify in the browser at /verify.Interlok produces evidence, not certification. Defense supplier? The CMMC evidence map shows what it covers and what stays in your own program.
| Action | Default |
|---|---|
| Reads, search, summarize | Passes |
| Routine writes (tickets, internal messages) | Passes, recorded |
| Payments, prod writes, deletes, permission changes, CUI leaving | Held for a human |
| Actions no one should approve | Denied |
Defaults work on day one, and every rule is editable as code.
A proxy and one config file. Point your agent's MCP servers through it and the gate is live.
Every rule is declarative and versionable, with an API and CLI to manage it.
p50 8 ms, p95 25 ms for an automatically allowed verdict — measured at the gate, shown on your overview page next to the contract it has to meet. Human-held actions wait for a determination instead.
Interlok sits at the tool call, not in front of your network. Your gateway, VPN, and identity provider stay where they are.
Wrap each MCP server's command with the Interlok proxy. Calls are asked of the gate before they reach the server; nothing else changes.
{
"mcpServers": {
"github": {
"command": "npx",
"args": ["-y", "@interlok/cli", "proxy", "--name", "github", "--agent", "support-bot",
"--", "npx", "-y", "@modelcontextprotocol/server-github"],
"env": { "INTERLOK_API_KEY": "ilk_live_…" }
}
}
}Not ready to enforce? Run your agent's tests under npx @interlok/cli shadow -- npm test: every call is recorded and allowed, and you get a signed report of what it reached for. Writing your own agent? Use @interlok/sdk: interlok.guard(call, () => run()).
Building on Copilot Studio, Agentforce, OpenAI, Claude, Google ADK, Bedrock AgentCore, LangGraph, CrewAI or a coding agent? See the setup for each platform.
It doesn't certify you, build agents, filter prompts, or replace your identity provider. It governs the one moment that matters: when an agent tries to change something real.