Skip to main content
The commands that run or configure a sandbox — bare airlock, airlock <agent...>, setup mcp, stop, and init — act on the current working directory: the repo you are in is the repo that gets mounted, and policy is resolved from it. build, login, logout, version, help, and proxy do not. publish is also independent of the working directory: it reads transcripts from ~/.airlock/agent/, egress logs from ~/.airlock/logs/, and your identity from ~/.airlock/auth.json, so it covers every repo you have sandboxed, not just the current one.

​
airlock

Opens a shell inside the sandbox for the current repo.
Starts (or reuses) the repo’s proxy container, then runs a fresh sandbox container attached to your terminal. The sandbox is removed when the session exits; the exit code is passed through. If you have run airlock login, your identity rides into both containers as environment ids (never tokens), and every audit line and published event is attributed to you. Without it, the launch continues after a one-line warning and the session’s events are unattributed until you log in.
Identity is set when the proxy container starts. If a proxy outlives one person’s login session on a shared machine, attribution follows whoever was logged in at container start — restart the sandbox after switching accounts.

​
airlock <agent…>

Runs a command inside the sandbox instead of opening a shell.
Any argument that is not a known subcommand is treated as the command to run, so airlock claude is shorthand for airlock run claude. Use the explicit run form when your command name would collide with a subcommand:

​
airlock login

Signs this machine in.
Prompts for the backend URL, your email, and your password (created by your admin in the console). The backend exchanges them for an API token, cached in ~/.airlock/auth.json (mode 0600), separate from secrets.toml. After login, sandbox sessions carry your identity and airlock publish ships under it. The token is bound server-side to your account; events claiming anyone else are rejected. It is further scoped to ingestion: it cannot read anyone’s timeline.

​
airlock logout

Best-effort revokes the token server-side, then deletes ~/.airlock/auth.json regardless of whether the network call succeeded. A lost connection never leaves you “stuck logged in.”

​
airlock setup mcp

Interactively enables an MCP connector for the current repo.
Presents the connector menu, prompts for credentials, then writes to three places: credentials to ~/.airlock/secrets.toml, the enable flag to .airlock.toml, and the server registration to .mcp.json. See MCP connectors for the full flow.

​
airlock publish

Ships two event sources to the backend — no third-party service is involved:
  • Sandbox transcripts from ~/.airlock/agent/claude/projects/ — prompts, replies, tool calls, and returned results, as chat events.
  • Proxy egress logs from ~/.airlock/logs/<repo>/ — every allowed and denied connection attempt, as identity-attributed access events.
Requires airlock login first. Publishing authenticates with your token, and the server attributes every event to it. There is no schema to create: the backend migrates its own database. Re-running is safe: ingestion is insert-only and idempotent — an event already received is skipped, never rewritten. --watch republishes any file that grew, covering both sources, so the console can follow a session that is still running.
Only the first argument is checked for a flag. airlock publish --watch works; a flag in any later position is silently ignored and a one-shot publish runs instead.
See audit log for exactly what each source ships and how long content is retained.

​
airlock dashboard

The console is no longer a local server — it is served by the backend itself, login-gated and multi-user. This command exists as a signpost: it prints your deployment’s console URL (from ~/.airlock/auth.json) instead of failing as an unknown command. See console.

​
airlock build

Fetches the airlock/base and airlock/proxy images, pinned to match the CLI’s release.
The default is a registry pull — no source tree required, which is what makes installed binaries work anywhere Docker does. Building the images locally from images/*/Dockerfile remains the contributor path via make images in a checkout.

​
airlock stop

Removes the current repo’s proxy container.
Idempotent — nothing running is success, not an error. The backend is unaffected; stop it with docker compose down in deploy/ (see deploy).

​
airlock init

Writes a commented example .airlock.toml into the current directory.
Errors if .airlock.toml already exists — it will not overwrite your policy.

​
airlock version

Also available as airlock --version.

​
airlock help

Also available as airlock -h and airlock --help.

​
Make targets

For working on Airlock itself: