Chock.sh Build your plugin
Coding agents
Blocksv0.6.1

Verify MCP Allowlist

Refuses a matched shell command before it runs. Blocks on an agent's file writes and at turn end.

Acts on

Shell command · File write · Turn end

When

Before the command runs · before the file write · at turn end

Tested

116 of 116 pass

In a git repo

At commit

What it does

Gates MCP servers against .chock/mcp-allowlist.json, empty by default (name, launcher with exact args, or url host). Shell guard refuses <agent> mcp add and shell writes of MCP configs or the allowlist unless listed. Script gate (commit, tool use, turn end) reads 13 client configs: a server off the list, or with other command, args or url host, refuses; unpinned or shell launchers, http, literal credentials, old versions only warn. Misses: aliases, scripts, gitignored files, other clients.

Chock adds friction. It is not a security boundary.

Its label on each agent

The catalog grades each policy on each agent. Pick an agent to build with this policy:

  • Claude Code TestedBlocks Refuses a matched shell command before it runs. Blocks on an agent's file writes and at turn endBuild →
  • Cursor TestedBlocks Refuses a matched shell command before it runs. Blocks on an agent's file writes and at turn endBuild →
  • Codex TestedBlocks Refuses a matched shell command before it runs. Blocks on an agent's file writes and at turn end. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run)Build →
  • GitHub Copilot TestedBlocks Refuses a matched shell command before it runs. Blocks at turn end only. It does not check a file write when it happens. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run)Build →
  • Devin TestedBlocks Refuses a matched shell command before it runs. Blocks at turn end only. It does not check a file write when it happens. If the hook errors, the action goes through (vendor docs only, not witnessed)Build →
  • Grok Tested Not graded yet for GrokBuild →
  • goose Tested Not graded yet for gooseBuild →
  • Antigravity Tested Not graded yet for AntigravityBuild →
  • OpenHands Untested Not graded yet for OpenHandsBuild →
  • Kimi Code Untested Not graded yet for Kimi CodeBuild →
  • Factory Droid Untested Not graded yet for Factory DroidBuild →

See it in action

Refused

An agent writes .mcp.json naming a server that is not on the allowlist.

tee .mcp.json <<'EOF'
{"mcpServers": {"evil": {"command": "npx", "args": ["-y", "[email protected]"]}}}
EOF

Allowed

An agent reads the MCP config and the allowlist.

cat .mcp.json .chock/mcp-allowlist.json

Both examples are this policy's own test cases.

What it misses

Aliases, scripts, gitignored files, other clients.

Latest change

0.6.1 · · Lint, no behaviour change: the printf argument count of the whole-text form is a named constant.