AgentLock

Stop AI coding agents from touching secrets, running unsafe commands, or overusing MCP tools without explicit policy.

AgentLock is a local MCP server plus Claude Code and Codex plugin packaging. It gives each agent task a permission capsule for files, shell commands, secret reads, network egress, MCP tools, and actions that require approval.

Install

Install the MCP server directly from npm in Claude Code:

claude mcp add agentlock -- npx -y @idevelopers/agentlock

Or install the Claude Code plugin from the public installer marketplace:

/plugin marketplace add https://github.com/manish-1988/agentlock-installer
/plugin install agentlock@agentlock-marketplace

For local source development from this private repository:

npm install
npm run build
node dist/index.js

Polar handles paid licenses; npm distributes the runtime package. The public installer repository contains only plugin metadata and points Claude/Codex at npx -y @idevelopers/agentlock.

Free, Pro, Team

Free is the local AgentLock scanner and starter policy generator. The source repository remains private; the public installer repository only contains plugin metadata that points to the public npm runtime.

| Capability | Free | Pro | Team | | --- | --- | --- | --- | | Local AI-agent/MCP risk scan | Yes | Yes | Yes | | Starter policy generation | Yes | Yes | Yes | | Action checks against policy | No | Yes | Yes | | Guarded command execution | No | Yes | Yes | | Redacted local audit log | No | Yes | Yes | | Shared policies, signed bundles, seats | No | No | Yes |

Pro is intended for $19/dev/month or local INR equivalent. Team is intended for $99/team/month with seats.

The AgentLock live checkout URL is added after the Polar product is created. Until then, set AGENTLOCK_CHECKOUT_URL locally during sandbox or live payment validation.

Policy

Create agentlock.policy.json in your repo. Start from agentlock.policy.example.json or call agentlock_generate_policy.

{
  "version": 1,
  "defaultCapsule": "default",
  "capsules": [
    {
      "id": "default",
      "allowedFiles": ["**"],
      "deniedFiles": [".env", ".env.*", "~/.aws/**", "~/.ssh/**"],
      "allowedCommands": ["npm test", "npm run", "git status", "git diff"],
      "deniedCommands": ["rm", "sudo", "npm publish", "git push"],
      "approvalRequired": ["secret-read", "package-publish", "git-push"]
    }
  ]
}

For smoke tests or nonstandard filenames, point AgentLock at a specific policy:

export AGENTLOCK_POLICY=agentlock.policy.example.json

Tools

• agentlock_scan_environment: free local risk scan for secret-adjacent files and agent/MCP config.
• agentlock_generate_policy: free starter permission capsule generator.
• agentlock_check_action: Pro policy decision for file, command, network, and MCP actions.
• agentlock_run_guarded_command: Pro command runner using child_process.spawn with shell:false.
• agentlock_audit_log: Pro redacted local audit log.
• agentlock_activate_license: store and verify a Polar license key.

License Activation

AgentLock uses Polar license keys and caches successful validation in ~/.agentlock/license.json with a 72-hour offline grace window for Pro and Team licenses.

For sandbox checks, set both values:

export POLAR_ENVIRONMENT=sandbox
export POLAR_ORGANIZATION_ID="your_sandbox_org_id"
export AGENTLOCK_CHECKOUT_URL="your_sandbox_checkout_url"

Then call agentlock_activate_license with the Polar license key. By default the activation label is agentlock-local; override it with AGENTLOCK_ACTIVATION_LABEL if you want a more specific device label in Polar.

Security

AgentLock runs locally and does not upload files or secrets to an AgentLock server. The scanner reports file presence and risky surfaces, not secret values. Reports, command output tails, and audit entries are redacted.

Guarded commands run with shell:false and a sanitized environment that strips secret-like variables. Treat agentlock.policy.json like a CI or firewall file: review it before trusting an agent task.

Development

npm install
npm run build
npx vitest run
npm pack --dry-run

The package binary is agentlock, mapped to dist/index.js.