Skip to main content
An MCP connector lets the agent read an internal system from inside the sandbox. Enabling one is a policy change: Airlock stores the credentials outside the repo, allowlists only that connector’s domains, and registers the server so the agent picks it up.

​
Available connectors

Notion

Notion workspace access via notion-mcp-server.Needs: an integration token from notion.so/profile/integrationsAllows: api.notion.com

Confluence

Atlassian Confluence access via mcp-atlassian-confluence.Needs: site name, account email, and an API token from id.atlassian.comAllows: <your-site>.atlassian.net
Both server binaries are preinstalled in the airlock/base image, so there is nothing to install inside the sandbox.

​
What setup writes

airlock setup mcp prompts for each credential (token input is hidden) and then writes to exactly three places:
1

Credentials → ~/.airlock/secrets.toml

Stored outside every repo, keyed by connector name, with file mode 0600. Credentials are never written into the repo.
2

Enable flag → .airlock.toml

Adds the connector to [mcp] enable so the sandbox knows to wire it up.
3

Server registration → .mcp.json

Adds the server command under mcpServers so Claude Code auto-detects it. No credentials go in this file — the server inherits its environment from the sandbox.
Then run the agent and the tools are available:

​
How credentials reach the server

Nothing is baked into .mcp.json. At sandbox start, Airlock reads the stored secrets and injects them as environment variables that the stdio MCP server reads: If a credential is missing, Airlock prints a warning naming the connector and the missing field, and starts the sandbox without it rather than failing.

​
Domains are derived, not guessed

Each connector declares the domains it needs, and Airlock adds only those to the egress allowlist. Confluence declares {site}.atlassian.net, and the {site} placeholder is filled in from your stored credential — so the allowlist ends up containing your specific site, not all of Atlassian. A domain whose placeholder cannot be resolved is dropped rather than allowed broadly.

​
Enabling by hand

You can skip the prompts and edit policy directly:
.airlock.toml
The credentials still have to exist in ~/.airlock/secrets.toml — run airlock setup mcp at least once per connector, or write the file yourself.
If .airlock.toml already has an [mcp] section that does not list this connector, airlock setup mcp stops and asks you to add the name to the existing enable list by hand.It aborts at that point, so only the credentials have been saved — .mcp.json is not written. After editing the enable list, either add the server to .mcp.json yourself or re-run airlock setup mcp, which now sees the connector already enabled and continues to the registration step.(If the connector is already in the list, setup proceeds normally and simply leaves .airlock.toml untouched.)