Your agents can already reach money, data, and production. Interlok finds those paths, locks the risky ones, and proves every decision.
Interlok scans your agent setup: MCP servers, tools, and the credentials behind them. It maps every path from an agent to something consequential.
Each path is scored on three things:
You get: a map of agent → tool → business process, with every ungated write path flagged.
Route tool calls through the Interlok proxy. Each call is checked against policy in real time.
We gate actions, not agents. Reads, searches, and routine work pass through untouched. Only high-impact actions stop: moving money, writing to production, deleting data, changing permissions.
Not sure what to lock? Run in shadow mode first. See what would be held, tune your policy, then enforce.
A held action waits for a human. Approve or deny in Slack or the console, with your identity verified through your identity provider.
An agent can never approve an agent.
Every decision is signed and hash-chained into a tamper-evident ledger, using keys you hold.
Export evidence for auditors or customer security reviews, and verify it offline without us. It also streams to your SIEM.
Every Shadow run and Gate decision produces a signed receipt you can verify offline.
From sign-in to a bundle your auditor, your customer or a prime can verify. Steps 3 and 4 need Gate; with Evidence Connect alone, the evidence comes from the gateway you already run.
GET /api/v1/attestations/{id}/bundle. The recipient runs interlok verify with no account. Proof Export (.ilproof) bundles also verify in the browser at /verify.Interlok produces evidence, not certification. Defense supplier? The CMMC evidence map shows what it covers and what stays in your own program.
| Action | Default |
|---|---|
| Reads, search, summarize | Passes |
| Routine writes (tickets, internal messages) | Passes, recorded |
| Payments, prod writes, deletes, permission changes, CUI leaving | Held for a human |
| Actions no one should approve | Denied |
Defaults work on day one, and every rule is editable as code.
A proxy and one config file. Point your agent's MCP servers through it and the gate is live.
Every rule is declarative and versionable, with an API and CLI to manage it.
p50 8 ms, p95 25 ms for an automatically allowed verdict — measured at the gate, shown on your overview page next to the contract it has to meet. Human-held actions wait for a determination instead.
Interlok sits at the tool call, not in front of your network. Your gateway, VPN, and identity provider stay where they are.
Wrap each MCP server's command with the Interlok proxy. Calls are asked of the gate before they reach the server; nothing else changes.
{
"mcpServers": {
"github": {
"command": "npx",
"args": ["-y", "@interlok/cli", "proxy", "--name", "github", "--agent", "support-bot",
"--", "npx", "-y", "@modelcontextprotocol/server-github"],
"env": { "INTERLOK_API_KEY": "ilk_live_…" }
}
}
}Not ready to enforce? Run your agent's tests under npx @interlok/cli shadow -- npm test: every call is recorded and allowed, and you get a signed report of what it reached for. Writing your own agent? Use @interlok/sdk: interlok.guard(call, () => run()).
Building on Copilot Studio, Agentforce, OpenAI, Claude, Google ADK, Bedrock AgentCore, LangGraph, CrewAI or a coding agent? See the setup for each platform.
Every model run gets a signed receipt: which model, which provider, which endpoint and region, and what it ran on, by hash. Receipts are built from the OpenTelemetry you already emit, so Interlok never sits in the inference path and adds no latency to a call. Prompts and completions are hashed on arrival and never stored; teams that keep content inside their boundary send only the hashes.
A boundary policy says where inference on governed data may run (for example, CUI only on GovCloud endpoints). A run outside it is recorded against the receipt and alerted on. Model promotions (a provider swap, new weights, a floating alias, a failed eval) go through the Change Gate and wait for a person like a risky deploy.
exporters:
otlphttp/interlok:
traces_endpoint: https://interlok.io/api/v1/inference/sources/<source id>/v1/traces
encoding: json
headers:
Authorization: Bearer ${env:INTERLOK_API_KEY}Interlok doesn't certify you, build agents, filter prompts, run evals, or replace your identity provider. It governs the moment an agent or a model change tries to touch something real, and proves what happened.
Routine calls pass straight through. For an automatically allowed verdict, measured gate overhead is p50 8 ms and p95 25 ms. Held actions wait for a person and are not part of that figure. Inference receipts are built out of band and add nothing to a model call.
Anything that calls tools over MCP: Copilot Studio, Agentforce, the OpenAI Agents SDK, Claude, Google ADK, Bedrock AgentCore, LangGraph, CrewAI, and the coding agents in GitHub Copilot and Cursor. Setup for each platform.
No. It gates actions, not agents. An agent that only reads, searches or drafts runs exactly as it does today.
Every tool is scored on reach, capability and consequence, using the real scope of its credentials rather than the tool's own description. You confirm the map before anything is enforced.
No. Your gateway routes traffic. Interlok adds the stop and the proof, or signs what your gateway already records with Evidence Connect.
You do. Every record is signed with your keys and hash-chained, and you can verify evidence offline without calling us.
Each connection decides. The default is fail closed: the tool call fails rather than running ungoverned. A connection set to fail open has its calls ledgered retroactively.
No. Inference receipts hold hashes of prompts and completions, never the text, and the verifier rejects any receipt that carries content.
Yes. The CMMC pack maps the signed record to all 110 NIST SP 800-171 requirements and names the ones that live in your own program (see Defense). The EU AI Act pack covers the runtime obligations for high-risk systems: automatic logs, human oversight and monitoring.
Derived data, yes: you set the window, with a floor set by the packs you turn on. Decisions, holds, determinations and anchors are kept for the life of the organization, because a chain with a hole in it proves nothing.