Interlock

// Add to Claude Desktop configuration (claude_desktop_config.json)
{
  "mcpServers": {
    "interlock": {
      "command": "uvx",
      "args": ["interlock-mcp", "serve", "--policy", "/path/to/interlock.policy.yaml"]
    }
  }
}

Repository About & Topics

About

A zero-trust Model Context Protocol (MCP) server that gives AI agents native, governed access to the CAD, EDA, and SPICE tools already installed on your machine.

Topics / Tags

mcp · model-context-protocol · zero-trust · cad · eda · spice · freecad · kicad · ngspice · ltspice · fusion360 · governance · security · python

Related MCP server: Universal Netlist MCP Server

Table of Contents

• What is Interlock?

• Key Features

• System Architecture

• Mathematical / Technical Formulation

• Setup & Installation

• Connecting to AI Clients

• How to Use

• Reference Tables

• Benchmarks / Comparisons

• Scope & Limitations

• File Structure

• Troubleshooting

• Deployment & GitHub Release

• Security Policy

• Code of Conduct

• Contributing

• License

• Acknowledgments

What is Interlock?

Interlock sits between an MCP client (Claude Desktop, Claude Code, or any MCP host) and desktop engineering software (FreeCAD, KiCad, ngspice). It exposes one normalized MCP interface so an agent can sketch parts, route PCBs, or run SPICE simulations without ungoverned, destructive access.

Instead of granting raw macro or IPC access, Interlock enforces policy governance:

• Deny-by-Default Grants: Capabilities remain disabled until explicitly enabled in interlock.policy.yaml.

• Git-Style Staging: Mutating tool calls operate on a shadow copy; live files remain untouched until an explicit commit.

• Domain-Aware Diffing: Outputs structural deltas (solids/volume for CAD, nets/tracks for EDA, elements for SPICE) rather than text or binary diffs.

Key Features

• Non-Downgradable Destructive Tier: destructive-tier capabilities (e.g. cad.delete_feature, eda.delete_track, fs.write_file) are strictly approval-required. Policy loading fails if set to auto.

• Local-First Processing: Sockets, subprocesses, and file operations remain 100% local on host hardware.

• SQLite Audit Store: Every tool call, domain diff, timestamp, decision, and SHA-256 diff hash is logged to .interlock/audit.db.

• In-Chat Approval & CLI Fallback: Inline review via elicitation/create or terminal fallbacks (interlock approve <session-id>, interlock reject <session-id> --reason "...").

• Path Scoping: Restricts access strictly inside project_root. Deny rules (file_scope.deny) take precedence over allow rules.

System Architecture

Interlock proxies communication between MCP clients and local engineering binaries:

graph TD
    Client["MCP Client (Claude Desktop / CLI)"] -->|JSON-RPC 2.0 stdio/HTTP| PolicyEngine["Interlock Policy Engine"]
    PolicyEngine -->|Policy Check| DiffEngine["Sandbox & Diff Engine"]
    DiffEngine -->|Log Event & Hash| AuditStore[("SQLite Audit Store .interlock/audit.db")]
    DiffEngine -->|Staged Automation| Adapters["Adapter Layer (FreeCAD / KiCad / ngspice / Workspace)"]
    Adapters -->|Local Sockets & SCLI| LocalTools["Host Engineering Tools & Files"]

    classDef default fill:#0f172a,stroke:#3b82f6,stroke-width:2px,color:#fff;
    classDef process fill:#1e1b4b,stroke:#a855f7,stroke-width:2px,color:#fff;
    class PolicyEngine,DiffEngine process;

Mathematical / Technical Formulation

1. Sallen-Key Low-Pass Filter Cutoff Frequency

Interlock validates analog SPICE simulation results against the theoretical closed-form cutoff equation:

$$f_c = \frac{1}{2 \pi \sqrt{R_1 R_2 C_1 C_2}}$$

Where:

• $f_c$ — Cutoff frequency in Hertz (Hz)

• $R_1, R_2$ — Filter resistor values in Ohms ($\Omega$)

• $C_1, C_2$ — Filter capacitor values in Farads (F)

When $R_1 = R_2 = R$ and $C_1 = C_2 = C$:

$$f_c = \frac{1}{2 \pi R C}$$

Verification Target: Simulated AC sweep cutoff frequency must be within 2% of theoretical target frequency.

Setup & Installation

Option A: 1-Click Setup with uv or pip

# Recommended
uv tool install interlock-mcp

# Or with pip
pip install interlock-mcp

Option B: From Source

git clone https://github.com/IamOumarIbrahim/interlock-mcp.git
cd interlock-mcp
pip install -e .

Verification Command:

interlock doctor

Expected Output:

Interlock v0.4.2 — environment check

  ✓ python      3.12.3
  ✓ freecad     FreeCAD 1.0.1 found at /usr/bin/freecadcmd
  ✓ kicad       KiCad 9.0.2 — IPC API reachable on /tmp/kicad/api.sock
  ✗ ngspice     binary not found on PATH
  ✓ workspace   C:\Dev\interlock is readable and writable

1 adapter needs attention — run `interlock doctor --fix` for platform-specific install instructions.

Connecting to AI Clients

1. Open your Claude Desktop configuration file:

   • macOS: ~/Library/Application Support/Claude/claude_desktop_config.json

   • Windows: %APPDATA%\Claude\claude_desktop_config.json

   • Linux: ~/.config/Claude/claude_desktop_config.json

2. Add Interlock to mcpServers:

{
  "mcpServers": {
    "interlock": {
      "command": "uvx",
      "args": [
        "interlock-mcp",
        "serve",
        "--policy",
        "/path/to/project/interlock.policy.yaml"
      ]
    }
  }
}

How to Use

1. Initialize policy configuration in your project root:

interlock init

2. Verify environment health:

interlock doctor

3. Approve or reject staged agent actions:

# Approve staged session
interlock approve 8f2c-af31

# Reject staged session with reason
interlock reject 8f2c-af31 --reason "Untrusted footprint modification"

4. View audit logs and replay sessions:

interlock audit tail
interlock audit show 8f2c-af31
interlock audit replay 8f2c-af31 --adapter kicad

Reference Tables

Configuration Schema (interlock.policy.yaml)

Environment Variables

Benchmarks / Comparisons

Scope & Limitations

• Application Security Boundary: Interlock does not sandbox underlying binaries (FreeCAD, KiCad, ngspice); it inherits their real system privileges.

• Semantic Engineering Decisions: Interlock enforces capability permissions and risk policy, not whether a specific CAD parameter is good engineering practice.

• Export Control Compliance: Audit logs provide full session traceability; compliance policies (ITAR/EAR) must pair Interlock with organizational host controls.

File Structure

interlock-mcp/
├── src/interlock/
│   ├── adapters/          - Adapter implementations (FreeCAD, KiCad, ngspice, workspace, LTspice, Fusion 360)
│   ├── audit.py           - SQLite audit store (.interlock/audit.db)
│   ├── cli.py             - Click CLI commands (init, doctor, serve, approve, reject, audit)
│   ├── diff.py            - Domain-aware diffing engine
│   ├── math_utils.py      - Sallen-Key low-pass filter equations & verification
│   ├── policy.py          - Zero-trust PolicyEngine & rule enforcement
│   └── server.py          - MCP Server implementation
├── tests/                 - Pytest suite (100% pass rate)
├── interlock.policy.yaml  - Default policy configuration
├── pyproject.toml         - Build configuration & dependencies
├── REQUIREMENTS.md        - Extracted specification checklist
└── VERIFICATION.md        - Verification matrix & test evidence

Troubleshooting

Deployment & GitHub Release

Automated CI/CD & Deployment

Interlock uses GitHub Actions (.github/workflows/deploy.yml) for automated testing, linting, packaging, and GitHub Releases upon tag creation.

# Tag a release
git tag -a v0.4.2 -m "Release v0.4.2"
git push origin v0.4.2

Security Policy

Security issues are taken seriously. See SECURITY.md for vulnerability reporting procedures.

Code of Conduct

We are committed to providing a welcoming community. See CODE_OF_CONDUCT.md.

Contributing

Contributions and new adapters are welcome! See CONTRIBUTING.md and docs/writing-an-adapter.md for details.

License

MIT © 2026 Interlock Maintainers

Powered By

Model Context Protocol · FreeCAD · KiCad · ngspice

If Interlock keeps your engineering tools safe, starring the repo helps others find it!