Best for
- Developers and users who need strict security policies for AI agents
- Teams that want to define security boundaries in natural language without sacrificing autonomy
- Security researchers running agents in untrusted environments
I
IronCurtain
Community
A secure runtime for autonomous AI agents, with policy from plain-English constitutions.
GitHub source repository ↗
52FMRS · D
IronCurtain provides a secure runtime for AI agents by compiling natural-language security policies into deterministic rules. It supports multiple modes and MCP servers, but as a research prototype, users need to carefully review policies and understand the security model.
IronCurtain is a secure runtime for autonomous AI agents. It compiles human-readable constitutions into deterministic security policies and enforces them at runtime on every tool call, providing safety without sacrificing autonomy. It supports multiple modes including builtin agent (Code Mode) and Docker agent mode, and includes a policy engine, MCP servers, audit logs, and a web UI.
Tools
The tool list has not been reviewed yet.
Setup
- Install CLI globally:
npm install -g @provos/ironcurtain; 2. Set an LLM API key (e.g.,ANTHROPIC_API_KEY); 3. Runironcurtain setupfor the first-start wizard; 4. Useironcurtain muxfor interactive sessions.
Fit and risk
Not for
- Scenarios where no security policy is needed and the agent can run freely
- Simple tasks requiring minimal permissions or no external dependencies
- Users who want out-of-the-box functionality without understanding the security model
Required permissions
- Requires access to filesystem, network, API keys, etc., for file and network operations
- Requires Docker for Docker agent mode, providing strongest isolation
- Requires an LLM API key (Anthropic, Google, or OpenAI)
Risks and side effects
- Research prototype: APIs and configuration formats may change
- Policy compilation may misinterpret intent; always review compiled rules
- V8 isolate boundaries are not OS-level; a V8 zero-day could allow escape
- In Docker mode, approved domains get raw passthrough tunnels without content inspection
Troubleshooting
- Check API key is set correctly, or review `~/.ironcurtain/config.json`
- Ensure Docker is installed, and 'bubblewrap' and 'socat' are available for sandboxing
- If policy doesn't match intent, review `compiled-policy.json` and run `customize-policy` to refine constitution
- Node.js version must be 22, 24, or 26; run `ironcurtain doctor` to check
Use cases
Run autonomous AI agents securely in a sandbox, performing file, git, and API operations
Compile policies from plain-English constitutions into deterministic rules and verify them
Integrate with MCP servers like filesystem, git, GitHub, Google Workspace
Supported clients
Supported clients have not been confirmed yet.