provos/ironcurtain

What it solves

IronCurtain provides a secure runtime for autonomous AI agents to prevent "ambient authority"—the risk that an agent with full system access could delete files, exfiltrate data, or push malicious code due to prompt injection or model drift. It removes the need to choose between a restrictive, useless sandbox or the tedious process of manually approving every single action.

How it works

IronCurtain uses a "constitution-based" security model where users define security intent in plain English. An LLM pipeline compiles this natural language constitution into deterministic, non-LLM rules that are enforced at runtime.

Key architectural components include:

• Semantic Interposition: All agent interactions occur via Model Context Protocol (MCP) servers. Every tool call is intercepted by a policy engine that can allow, deny, or escalate the action to a human for approval.
• Sandboxing: Agents run in isolated environments—either a V8 isolate for built-in agents or a Docker container for external agents (like Claude Code or Goose)—with no direct host access.
• Trusted Input: In its terminal multiplexer mode, text typed by the user in command mode is captured as a verified intent signal, allowing the system to auto-approve subsequent agent actions that match that intent.
• Policy Compilation: The system translates English intent into JSON rules, generates test scenarios to verify those rules, and repairs them if they fail before deployment.

Who it’s for

Developers and researchers who use autonomous AI agents for coding, system administration, or vulnerability discovery and want to ensure the agent cannot perform destructive or unauthorized actions without explicit human oversight.

Highlights

• Constitution-to-Policy: Converts human-readable English instructions into deterministic security rules.
• Terminal Multiplexer: Provides a TUI that mediates tool calls with inline escalation pickers and trusted user input capture.
• ** uma-agent Orchestration**: Supports complex, multi-agent workflows (e.g., vulnerability discovery) with per-agent security boundaries.
• Persona Management: Allows creation of named policy profiles with their own constitutions, workspaces, and memory.
• Defense in Depth: Combines V8/Docker isolation with a MITM proxy for LLM API calls and a validating registry proxy for package installations.