Quickstart

Get airlock running with your AI agent in under 5 minutes.

Connect your agent

airlock exposes a single organization-wide MCP endpoint that gives your agent access to every integration in your organization. Pick your client below. Each one authenticates via MCP OAuth, so you sign in once and airlock caches your credentials for instant reconnects.

Already have an integration set up? That's all you need. New to airlock? Create your first integration with the steps below, then come back here to connect.

No browser available? Instead of OAuth you can create a personal API token under Settings → Account → Personal API tokens and send it as an Authorization: Bearer alk_pat_… header to the same endpoint. The token authenticates as you, with your access and your approval requirements. See Personal API tokens.

Prerequisites

• An airlock account at control-room.air-lock.ai
• Claude Desktop (or another MCP-compatible client) installed
• Admin role in your organization for Steps 1–2. Creating integrations and changing tool policies are admin-only; members can connect their own credentials (Step 3) and use the agent endpoint (Step 4), but the integration catalog is not shown to them.

If you're the first person from your company, you name your organization and pick the Solo or Team plan right after signing up, and you become its admin. If a colleague signed up before you on the same email domain, you choose: ask to join their organization (you'll see a "waiting for approval" screen until an admin approves you under Identities → Users), or create your own. Personal email domains always get their own isolated organization.

Step 1: Create an Integration

1. Log in to the airlock Control Room
2. Open Connectors from the sidebar
3. Add an integration one of two ways:

From a pre-built integration (recommended):

• Browse or search the catalog and click any of the 250+ integrations: GitHub, Linear, Notion, Google Calendar, Todoist, Sentry, PostHog, HubSpot, and more
• These come pre-configured, so no OpenAPI spec is needed

From your own API:

• As an admin, open Rules → Connectors, Add a system, then Build your own and pick OpenAPI (or MCP Proxy to wrap an existing MCP server)
• Give the Specification URL your OpenAPI document is published at and click Fetch, or paste the document (YAML or JSON)
• Click Analyze & Continue; the name is filled in from the spec's title on the next step, where you can change it
• The target API URL is optional: airlock uses the first server listed in your spec unless you set one later

Can't find a service? Click its Request tile, or search for it and use the Request "…" button, and airlock will try to add it.

4. Follow the wizard to finish creating the integration. Before it creates anything, it asks Who can use it?: everyone, or only the people and spaces you choose

Step 2: Set Policies on the Rules Page

Setting up an integration asks nothing about its tools: each tool's setting is set on the Rules page. A catalog integration's tools start as Allow, so agents can call them straight away. An API you add yourself starts on the Rules page's defaults: Read and Draft are Allow, and Write and Send wait for an admin's Approval. Either way, a category one of your house rules covers starts as Intelligent so each call is decided against that rule. By default, tools the integration adds later are held while airlock's security scan checks them: a clean result releases them, and a finding keeps them held for an admin. A custom API's new operations are not scanned, so they wait for an admin.

To change what a tool may do:

1. Open the Rules page and find the integration's connector in the Connectors row
2. Set each category (Read, Draft, Write, Send) to Allow, Intelligent, Approval or Block
3. For Approval, choose who approves: yourself, the space owner, the admins, or named people
4. To treat a single tool differently from its category, keep it as an exception

The integration's Tools tab, which only admins see, shows what a call to each tool gets. Its policy is a read-out: a tool's policy is changed on the Rules page. The tab still lets an admin edit a tool's description and mark it reviewed. Hiding a tool and syncing tools happen on the Rules page, for every connection of a connector at once. See Policies for how the two levels combine.

Step 3: Connect Your Account

Connect your credentials depending on the integration type:

For OAuth-based integrations (GitHub, Google Calendar, Linear, Notion, Sentry, etc.):

1. Go to your integration's detail page
2. Click Connect to authorize airlock to access the service
3. Complete the OAuth flow in the popup window

For API key-based integrations (Firecrawl, Bright Data, Odoo, etc.):

1. Go to your integration's detail page
2. Enter your API credentials and click Save

airlock checks most keys with the provider before saving. A key the provider refuses is not saved and the reason is shown; a working key shows Verified with the provider; a key that could not be checked is saved with a note saying so.

If an admin has shared one credential for the integration with your team, there is nothing to connect: your calls use the shared connection.

Step 4: Test It

With your agent connected (using the Connect your agent options at the top of this page), ask it to interact with your API:

"List my open pull requests on GitHub"

Your agent will use the MCP tools exposed by airlock to call your API.

Next Steps

• Creating Integrations - Integration types and configuration
• Pre-built Integrations - Full list of available integrations
• Policies - Set what each tool may do and who approves it
• Approval Workflows - Configure approvers and notifications
• Instructions - Author guidelines and prompts delivered to agents via MCP
• Skills - Create activatable capabilities that bundle instructions and optional attachments
• Security - Anomaly detection and auto-blocking