mcp-airlock-crunchtools 0.2.0

Secure MCP server for quarantined web content extraction — two-layer defense against prompt injection

mcp-airlock-crunchtools

Secure MCP server for quarantined web content extraction with two-layer prompt injection defense.

Tools (6)

Tool	Layers	Description
safe_fetch	L1	Fetch URL, sanitize, return markdown. Fails on injection.
safe_read	L1	Read local file, sanitize, return markdown. Fails on injection.
quarantine_fetch	L1+L2	Fetch URL, sanitize, extract via Q-Agent. Warns on injection.
quarantine_read	L1+L2	Read local file, sanitize, extract via Q-Agent. Warns on injection.
quarantine_scan	L1+L2	Pre-flight scan: detect injection vectors WITHOUT returning content.
quarantine_stats	—	Session stats, config, and blocklist summary.

Architecture

• Layer 1 (Deterministic): 7-stage sanitization pipeline strips hidden HTML, invisible unicode, encoded payloads, exfiltration URLs, and LLM delimiters.
• Layer 2 (Q-Agent): Quarantined Gemini Flash-Lite LLM for semantic content extraction — NO tools, NO memory, NO SDK.

Install

# PyPI
pip install mcp-airlock-crunchtools

# uvx (zero-install)
uvx mcp-airlock-crunchtools

# Container
podman run quay.io/crunchtools/mcp-airlock

Configuration

# Required for Layer 2 (Q-Agent)
export GEMINI_API_KEY=your-key

# Optional
export QUARANTINE_MODEL=gemini-2.0-flash-lite  # default
export QUARANTINE_FALLBACK=layer1              # or "fail"
export QUARANTINE_MAX_CONTENT=100000           # max chars to Q-Agent
export QUARANTINE_DB=/data/airlock.db          # SQLite blocklist path
export QUARANTINE_TRUST_CONFIG=~/.config/mcp-env/mcp-airlock-trust.json

Claude Code

{
  "mcpServers": {
    "mcp-airlock-crunchtools": {
      "command": "uvx",
      "args": ["mcp-airlock-crunchtools"]
    }
  }
}

License

AGPL-3.0-or-later