provos/ironcurtain

A secure* runtime for autonomous AI agents. Policy from plain-English constitutions. (*https://ironcurtain.dev)

IronCurtain – Secure Runtime for Autonomous AI Agents

What it is – IronCurtain is a research‑prototype platform that lets you run LLM‑driven agents (e.g., Claude Code, Goose, Codex) while keeping the host system safe. You write a short, human‑readable constitution that states what the agent may or may not do. IronCurtain uses an LLM‑based compiler to turn that text into a deterministic policy, validates the policy with generated test scenarios, and then enforces the rules at runtime for every tool call the agent makes.

Why it matters – Current agent frameworks give the model full user privileges (filesystem, network, credentials). A single prompt‑injection or drift can cause destructive actions. IronCurtain’s model‑context‑protocol (MCP) interposition and V8/Docker sandboxing provide defense‑in‑depth: the agent is treated as untrusted, and all external effects are mediated by a policy engine that can allow, deny, or escalate to the human.

Key concepts

  • Constitution → compiled policy – Write intent in plain English; the system annotates MCP tools, compiles if/then rules, resolves dynamic lists, generates test scenarios, and verifies the policy before use.
  • Policy engine – Runs outside the sandbox; every MCP request (filesystem, git, network, package install, etc.) passes through it.
  • Escalation UI – When a rule requires human approval, IronCurtain shows an overlay in the terminal multiplexer (Ctrl‑A command mode) or via a web UI, allowing one‑key approve/deny/whitelist.
  • Two agent modes –
    1. Builtin Agent (Code Mode) – IronCurtain’s own LLM writes TypeScript that executes in a V8 isolate.
    2. Docker Agent Mode – An external LLM runs inside a Docker container with no public network; all its API calls are MITM‑proxied and all MCP calls are policy‑checked.
  • Personas & Skills – Named policy profiles (personas) bundle a constitution, compiled rules, workspace, and semantic memory. SKILL.md packages can be mounted read‑only into every Docker session to give agents domain‑specific guidance.
  • Workflows – Pre‑built multi‑agent pipelines (e.g., vulnerability discovery, design‑and‑code) orchestrate several agents, each with its own policy, and expose a web UI for monitoring and human gates.

How to get started

  1. Install the CLI globally: npm install -g @provos/ironcurtain (requires Node 24/26).
  2. Export an LLM API key (ANTHROPIC_API_KEY, OPENAI_API_KEY, or GOOGLE_GENERATIVE_AI_API_KEY).
  3. Run ironcurtain setup – the wizard creates ~/.ironcurtain/config.json and helps you add a GitHub token, web‑search provider, etc.
  4. Launch the recommended terminal multiplexer: ironcurtain mux. The agent appears in a PTY; any tool call that needs approval pops up an inline picker.
  5. (Optional) Customize the policy: ironcurtain customize-policy → edit the generated constitution-user.md → ironcurtain compile-policy to rebuild the deterministic rules.

Running modes

  • ironcurtain start "<prompt>" – one‑shot task, builtin agent or Docker agent via --agent flag.
  • ironcurtain mux – full interactive TUI with escalation handling.
  • ironcurtain daemon --web‑ui – background service for scheduled jobs and a browser‑based UI.
  • ironcurtain workflow start <name> "<goal>" – launch a defined multi‑agent workflow.

Status – Labeled Research Prototype. The API, configuration format, and overall architecture are expected to evolve. The project includes CI, npm publishing, and a growing set of documentation (SANDBOXING.md, WORKFLOWS.md, etc.).

Where to learn more – Official site: https://ironcurtain.dev (includes the “What do we mean by secure?” FAQ). The repository contains detailed design docs, a demo GIF, and a web UI for workflow inspection.

Related

  • Project
    FonaTech/Clouds-Coder

    Clouds Coder is a local-first platform that provides a browser-based IDE and execution environment for AI coding agents, featuring a robust kernel for reliable task completion and a collaboration mode for team-based development.

  • Project
    StanleyNull/AutoHunter

    AutoHunter is an AI‑driven, Docker‑based platform that continuously hunts for web vulnerabilities. It uses LLM‑guided agents (Collector, Worker, Reviewer) together with real tools like nmap, nuclei, and sqlmap. Humans only perform final review. The system supports multiple search engines (FOFA, Quake, Shodan, etc.), offers a Vue dashboard, and persists data in SQLite. It’s licensed Apache 2.0 and intended for authorized security testing.

  • Project
    earendil-works/gondolin

    Gondolin is a Node SDK and CLI that runs AI‑generated code inside fast, disposable Linux micro‑VMs (QEMU or experimental krun). It lets you enforce programmable network and filesystem policies, inject secrets only for allowed destinations, snapshot and resume VMs, and expose guest services via an ingress gateway. Ideal for safely executing agent‑produced scripts, web‑scraping, or sandboxed browser automation.

  • Project
    BakeLens/crust

    Crust is an open‑source, locally‑run proxy that sits between AI coding assistants and LLM providers. It inspects every tool call (file reads, shell commands, network requests) and blocks actions that could expose secrets or harm the host. The gateway works as an HTTP proxy, MCP/ACP stdio wrapper, or Docker container, and includes 42 built‑in security rules, 51 DLP patterns, and a plugin system for custom policies. It runs entirely on the user’s machine, stores logs encrypted in the OS keyring, and offers iOS integration via a Swift package.

  • Project
    coleam00/Archon

    Archon is an open‑source workflow engine that makes AI‑assisted coding deterministic and repeatable. Define development processes (plan, implement, test, review, PR) as YAML workflows; Archon runs them in isolated Git worktrees, mixing AI nodes with deterministic bash steps, and provides a CLI, web UI, and chat‑platform adapters.