Airlock: Agent-Native Data Workspace

Inspiration

Every team has a spreadsheet nobody is allowed to paste into ChatGPT: compensation, customer lists, finances under NDA. Yet people paste anyway — roughly 11% of ChatGPT pastes contain confidential information, a fifth of breaches now involve shadow AI, and AI chats have been ruled discoverable in court. We wanted the analysis without the upload: AI help with data that physically cannot leave the room.

What it does

Airlock is a data workspace in a single browser tab. Your file is read locally and queried with in-browser DuckDB-WASM — nothing uploads, ever. An AI agent works on it through WebMCP tools the page exposes: 8 read tools that run immediately and are logged, and 12 staged actions where every change (filters, derived columns, charts, flags, reports, redaction, export) appears as a visible diff that nothing applies until you press Approve. An activity ledger records every call with exact rows disclosed. A signed attestation receipt — hashes and counts, never values — verifies offline at /verify.html. God mode runs a Qwen model fully on-device via WebGPU for genuine airplane-mode analysis, or bring your own endpoint key, which never leaves tab memory. It also imports PDF, DOCX and images OCR'd on-device into queryable tables.

How we built it

React 18 + Vite + TypeScript + Tailwind, npm workspaces. The reusable core is packages/webmcp-staged — a zero-dependency propose→review→commit primitive spanning WebMCP, OpenAI tool-calling and plain MCP transports. DuckDB-WASM, pdf.js, Tesseract and the model weights are all self-hosted same-origin; an egress monitor wrapping fetch/XHR/beacon/WebSocket proves zero bytes leave, live, in the top bar. 530+ tests, npm audit clean, Netlify deploy with COOP/COEP, WASM MIME types and origin-trial support.

Challenges we ran into

Honesty was harder than engineering: "data never leaves the browser" is false the moment a cloud agent reads query results, so cloud mode states plainly that slices travel (and counts them) while the fully-local loop makes the strong claim literally true. Small models were the second fight — 1.5B-parameter callers loop, invert comparisons and stuff GROUP BY into filter boxes — answered with schema-tolerant tools, corrective errors, repeat guards and a fail-fast circuit breaker. Third was host discovery: WebMCP gates on origin isolation and trial enrollment, which took real header and deploy work.

Accomplishments that we're proud of

A complete loop the camera can verify: offline analysis with Seal at zero, every mutation human-gated, a signed receipt that verifies offline, and an agent surface ChatGPT, a local model, your own endpoint, or the built-in console can all drive unchanged. Plus a reusable MIT primitive any WebMCP app can adopt for the same propose→approve→commit safety.

What we learned

Agent UX is approval UX — the review queue, not the chat, is where trust happens. A privacy claim the code can't back is worse than no claim at all. And tiny on-device models are usable agents if the tool surface is tight enough to hold them.

What's next for Airlock: Agent-Native Data Workspace

Depth over breadth: the pay-equity workflow first (EU Pay Transparency deadlines make the receipt a requirement, not a nicety), then adjacent regulated-data reviews. On the tech side: richer provenance-linked reports, local folder and localhost-database sources, and a second independent implementation of the staged-authority protocol so the receipt becomes an interoperable standard, not a single-app artifact.

Built With

• cache-api
• dompurify
• duckdb
• duckdb-wasm
• hugging-face
• indexeddb
• javascript
• marked
• mcp
• netlify
• node.js
• pdf.js
• react
• recharts
• tailwind-css
• tanstack-table
• tesseract.js
• typescript
• vite
• vitest
• web-crypto
• webgpu
• webllm
• webmcp