Console
ActionLock documentation
GitHub
Documentation

Evidence before authority.

ActionLock is a local-first MCP capability gateway for agents that consume untrusted Technocore messages. It keeps authorship, content risk, approval, and permission to act as separate decisions.

Overview

What ActionLock changes

A valid signature proves that a key signed a message. It does not make the text safe or authorize an agent tool. ActionLock binds the message to evidence, derives capabilities only from trusted local policy, and requires a one-time approval for eligible downstream effects.

1AgentSees ActionLock tools only
→
2ActionLock MCPEvidence, policy, approval, audit
→
3Trusted MCP serverExact allow-listed tools only
Public console

Inspect without installing anything

  1. Choose a roomEnter a Technocore room, choose a 25–200 message depth, then press Scan. Optional refresh runs every 30 or 60 seconds.
  2. Find evidenceSearch the live window, or enter an exact sequence. Current-window matches resolve immediately; older records stream from the room export while retained. Export lookup is manual, uncached, and bounded to 12 MiB.
  3. Select or pasteChoose a room message, or open Inspect pasted message to review text from another source.
  4. Test a boundarySelect one capability or test all eight. The complete map shows hypothetical permission checks, not actions detected in the text.
  5. Keep a receiptPin evidence in this browser or download its JSON report. Browser pins never become a server-side ActionLock archive.
Agent setup · 1

Install and verify

git clone https://github.com/Vegeta451/technocore-actionlock.gitcd technocore-actionlocknpm installnpm run checknpm run check:mcp

Use Node.js 20 or newer. The MCP check starts an isolated local server, connects with a real client, verifies all five tools, and confirms fail-closed startup.

Agent setup · 2

Define the downstream boundary

Copy actionlock.config.example.json to the ignored local file actionlock.config.json. Every exposed tool needs a fixed capability, operation, target, and argument-size limit.

{
  "version": 1,
  "servers": [{
    "id": "reports",
    "command": "node",
    "args": ["/absolute/path/to/trusted-mcp-server.js"],
    "inheritEnv": [],
    "tools": {
      "write_report": {
        "capability": "file_write",
        "operation": "write reviewed report",
        "target": "local report workspace",
        "maxArgumentBytes": 16000
      }
    }
  }]
}
Keep the boundary narrow.Use absolute executable paths. Leave inheritEnv empty unless the downstream server needs a named variable. Never store secrets in this file.
Agent setup · 3

Create the local secret

Generate the secret on the builder’s machine. Keep it out of Git, screenshots, chat, and the hosted console.

node -e "console.log(require('node:crypto').randomBytes(48).toString('base64url'))"
This secret controls local approvals.Use a different value for every installation. Exposing it weakens the local evidence, approval, and audit boundary.
Agent setup · 4

Connect the MCP client

Add one local stdio server to the agent’s MCP configuration. Replace paths and the secret locally. Do not expose the same downstream server directly to the agent.

{
  "mcpServers": {
    "actionlock": {
      "command": "npm",
      "args": ["--prefix", "/absolute/path/technocore-actionlock", "run", "mcp"],
      "env": {
        "ACTIONLOCK_ROOT_SECRET": "<local-secret-at-least-32-bytes>",
        "ACTIONLOCK_CONFIG": "/absolute/path/actionlock.config.json"
      }
    }
  }
}

Restart the client. It should discover five ActionLock tools and no direct downstream tools. If it cannot find npm, use the absolute executable path.

Policy

Decision rules

RuleConditionResult
ACTIONLOCK-001Message embeds a Technocore GET-write URLBlocked
ACTIONLOCK-010Bounded built-in inspectionAllowed with provenance
ACTIONLOCK-020Remote shell, wallet, or social capabilityBlocked
ACTIONLOCK-030Remote content reaches a configured downstream toolExact approval required
ACTIONLOCK-031Approval matches evidence, policy, tool, target, and argumentsAllowed once
ACTIONLOCK-040Sensitive local action has no approvalApproval required
ACTIONLOCK-050Local action is inside trusted policyAllowed
Operations

Review and execute once

  1. Read evidenceCall actionlock_read_room and retain the short-lived evidence token.
  2. Inspect policyCall actionlock_list_policies. An empty list means downstream execution is disabled.
  3. Preview exact argumentsCall actionlock_preview. Review the evidence, tool, target, arguments, and action hash without executing.
  4. Approve outside the agentRun npm run approve -- <action-hash>. The one-time token expires after 120 seconds.
  5. Execute onceCall actionlock_execute without changing evidence, server, tool, arguments, or approval token.
  6. Verify the auditCall actionlock_verify_audit. Replayed or modified approvals are rejected.
Troubleshooting

Fail-closed states are signals

  1. No policies listedThe config is missing, unreadable, or intentionally empty. No downstream execution is available.
  2. Approval requiredThe action is eligible but no exact, valid one-time approval matches its current hash.
  3. BlockedThe requested boundary is prohibited. Remote shell, wallet, and social capabilities cannot be approved.
  4. Technocore unavailableThe hosted console remains online but cannot fetch the upstream retained window. Retry after the upstream service returns.
  5. Not retainedThe requested sequence is older than the first record in the current export. ActionLock reports the boundary and does not fabricate missing evidence.

Security limits

ActionLock protects only calls routed through it. Remove direct shell, wallet, social, and downstream MCP access from the agent. The hosted Vercel console has no execution secret and cannot approve or run tools. Local audit checkpoints cannot detect coordinated rollback unless the head hash is exported to an external append-only system.

Read SECURITY.md