Keep the agents you build with. Add the lock and the proof.

How it reaches tools. Remote MCP servers over Streamable HTTP, added with the MCP onboarding wizard.

With Interlok. Run the proxy in front of your MCP server behind your HTTPS ingress, then add the ingress URL as the MCP server in Copilot Studio. Keep its existing auth: the client's credentials still reach your server.

# On your network, behind your HTTPS ingress (e.g. https://mcp.yourco.com)
export INTERLOK_API_KEY=ilk_...
npx -y @interlok/cli proxy --name crm --agent copilot-studio \
  --upstream https://crm.internal/mcp --host 0.0.0.0 --port 8787 --wait 25

# Copilot Studio → add an existing MCP server
#   Server URL: https://mcp.yourco.com/mcp

Copilot Studio supports Streamable HTTP only (no SSE). Use a short --wait so a held call returns its tag number before the platform's tool timeout.

Source: Microsoft Learn: connect an existing MCP server

How it reaches tools. A native MCP client for third-party MCP servers, governed by an MCP server registry.

With Interlok. Run the proxy in front of the MCP server you register, and register the proxy's HTTPS URL instead of the server's.

# On your network, behind your HTTPS ingress (e.g. https://mcp.yourco.com)
export INTERLOK_API_KEY=ilk_...
npx -y @interlok/cli proxy --name crm --agent agentforce \
  --upstream https://crm.internal/mcp --host 0.0.0.0 --port 8787 --wait 25

# Agentforce MCP registry → register the server at
#   https://mcp.yourco.com/mcp

Which custom MCP servers an org can register depends on its Agentforce release and edition; check with your Salesforce admin.

Source: Salesforce: Agentforce MCP support

How it reaches tools. Local (stdio) and hosted MCP servers as agent tools.

With Interlok. Launch your MCP server through the proxy. The agent sees the same tools; risky calls wait for a person.

import os
from agents import Agent
from agents.mcp import MCPServerStdio

github = MCPServerStdio(params={
    "command": "npx",
    "args": ["-y", "@interlok/cli", "proxy", "--name", "github", "--agent", "release-agent",
           "--", "npx", "-y", "@modelcontextprotocol/server-github"],
    "env": {"INTERLOK_API_KEY": os.environ["INTERLOK_API_KEY"],
            "GITHUB_PERSONAL_ACCESS_TOKEN": os.environ["GITHUB_TOKEN"]},
})
agent = Agent(name="release-agent", mcp_servers=[github])

Source: OpenAI Agents SDK: MCP

How it reaches tools. MCP servers configured per project or per agent.

With Interlok. Point the server entry at the proxy. Commit it in .mcp.json so every developer's agent goes through the gate.

{
  "mcpServers": {
    "github": {
      "command": "npx",
      "args": ["-y", "@interlok/cli", "proxy", "--name", "github", "--agent", "release-agent", "--", "npx", "-y", "@modelcontextprotocol/server-github"],
      "env": { "INTERLOK_API_KEY": "${INTERLOK_API_KEY}",
               "GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_TOKEN}" }
    }
  }
}

Source: Claude Code docs: MCP

How it reaches tools. MCP tools through McpToolset, over stdio or Streamable HTTP.

With Interlok. Give McpToolset the proxy as its command. For a remote server, use the HTTP proxy URL with StreamableHTTPConnectionParams.

import os
from google.adk.agents import LlmAgent
from google.adk.tools.mcp_tool import McpToolset, StdioConnectionParams
from mcp import StdioServerParameters

github = McpToolset(connection_params=StdioConnectionParams(
    server_params=StdioServerParameters(
        command="npx",
        args=["-y", "@interlok/cli", "proxy", "--name", "github", "--agent", "release-agent",
           "--", "npx", "-y", "@modelcontextprotocol/server-github"],
        env={"INTERLOK_API_KEY": os.environ["INTERLOK_API_KEY"],
             "GITHUB_PERSONAL_ACCESS_TOKEN": os.environ["GITHUB_TOKEN"]})))
agent = LlmAgent(model="gemini-2.5-flash", name="release_agent", tools=[github])

Source: ADK: MCP tools

How it reaches tools. AgentCore Gateway fronts existing MCP servers; AgentCore Policy can require approvals.

With Interlok. Make the proxy's HTTPS URL the MCP server target behind AgentCore Gateway. Already using AgentCore Policy? Keep it, and send its decisions to Evidence Connect so they are signed and verifiable outside AWS.

# On your network, behind your HTTPS ingress (e.g. https://mcp.yourco.com)
export INTERLOK_API_KEY=ilk_...
npx -y @interlok/cli proxy --name crm --agent agentcore \
  --upstream https://crm.internal/mcp --host 0.0.0.0 --port 8787 --wait 25

# AgentCore Gateway → add an MCP server target
#   https://mcp.yourco.com/mcp

Source: AWS: AgentCore FAQs

How it reaches tools. MCP tools through langchain-mcp-adapters (MultiServerMCPClient).

With Interlok. Register the proxy as the server command. Every graph that loads these tools is gated.

import os
from langchain_mcp_adapters.client import MultiServerMCPClient

client = MultiServerMCPClient({
    "github": {
        "transport": "stdio",
        "command": "npx",
        "args": ["-y", "@interlok/cli", "proxy", "--name", "github", "--agent", "release-agent",
           "--", "npx", "-y", "@modelcontextprotocol/server-github"],
        "env": {"INTERLOK_API_KEY": os.environ["INTERLOK_API_KEY"],
                "GITHUB_PERSONAL_ACCESS_TOKEN": os.environ["GITHUB_TOKEN"]},
    }
})
tools = await client.get_tools()

Source: LangChain: MCP adapters

How it reaches tools. MCP servers over stdio, SSE or Streamable HTTP.

With Interlok. Start the adapter with the proxy as the server command and hand its tools to your agents.

import os
from crewai import Agent
from crewai_tools import MCPServerAdapter
from mcp import StdioServerParameters

params = StdioServerParameters(
    command="npx",
    args=["-y", "@interlok/cli", "proxy", "--name", "github", "--agent", "release-agent",
           "--", "npx", "-y", "@modelcontextprotocol/server-github"],
    env={"INTERLOK_API_KEY": os.environ["INTERLOK_API_KEY"],
         "GITHUB_PERSONAL_ACCESS_TOKEN": os.environ["GITHUB_TOKEN"]})

with MCPServerAdapter(params) as tools:
    agent = Agent(role="Release manager", goal="Ship safely", backstory="...", tools=tools)

Source: CrewAI: MCP

How it reaches tools. MCP servers listed in the editor's or repository's MCP configuration.

With Interlok. Wrap each server in the proxy in .cursor/mcp.json or .vscode/mcp.json. Coding agents are where most production writes start.

{
  "mcpServers": {
    "github": {
      "command": "npx",
      "args": ["-y", "@interlok/cli", "proxy", "--name", "github", "--agent", "release-agent", "--", "npx", "-y", "@modelcontextprotocol/server-github"],
      "env": { "INTERLOK_API_KEY": "${env:INTERLOK_API_KEY}" }
    }
  }
}

VS Code uses a top-level "servers" key instead of "mcpServers". Interlok's free scan reads both files.

Source: GitHub Docs: extend the coding agent with MCP

How it reaches tools. Direct API calls from your tool functions.

With Interlok. Wrap the risky function in guard() with the TypeScript SDK, or call the gate API from any language before you act.

import { Interlok } from "@interlok/sdk";

const il = new Interlok({ agent: "refund-agent" }); // INTERLOK_API_KEY from env
await il.guard(
  { tool: "payments/create_refund", args: { charge, amount_usd: 4800 } },
  () => stripe.refunds.create({ charge, amount: 480000 }),
); // runs if allowed or released by a person; throws if denied or still held

// Any language: ask the gate before you act
curl -X POST https://interlok.io/api/v1/gate \
  -H "authorization: Bearer $INTERLOK_API_KEY" -H "content-type: application/json" \
  -d '{"agent":"refund-agent","tool":"payments/create_refund","args":{"amount_usd":4800}}'

Source: Interlok docs