Every AI agent runs inside your shell, wired straight to your real API keys, database URLs, and tokens. It doesn't forget what it reads, either. ironrun seals them in one encrypted workspace, hands the agent a time-boxed lease instead of the value, and redacts anything that slips into output. The agent finishes the job. It never sees the secret.
Keys, database URLs, tokens: if it's in your environment, the agent can read it. And it doesn't forget. Claude Code logs every tool call to ~/.claude/projects, argument by argument. A secret that passed through one command is sitting in that file, in plaintext, right now.
Drop a YAML file in your project. ironrun handles the vault, the subprocess, and the output. Your agent calls one tool. It gets back exit code, timing, and redacted output. Never the secret values that ran inside.
Secrets live in ironrun's local encrypted vault: AES-256-GCM, on your machine. Or federate to 1Password, Vault, Doppler, or Infisical. Pulled at exec time. Never written to disk.
version: "2"
environment_set: active
commands:
- id: deploy
secrets: [STRIPE_SECRET, AWS_SECRET]
Runs with a clean environment and no shell. Nothing to inject through. Only the command you named runs.
commands:
- id: deploy
argv: [./deploy.sh, --prod]
ttl: 30s
no_network: true
Every byte of output runs through a rolling pattern match before the agent sees it. A secret shows up in stdout? Gone before it leaves the process.
exit_code: 0
duration_ms: 191
stdout: "Deployed. key=[REDACTED]"
ironrun assumes your agent is compromised. Every layer blocks exfiltration on its own. Fail one, the others hold.
The agent asks for access, you approve a time-boxed lease, and only then does a sealed process ever touch a secret. Secrets exist only inside that process. Never serialized. Never logged. Never in the agent's context. This isn't a wrapper around your commands. It's a wall between your secrets and the model.
ironrun stores secrets in a local AES-256-GCM vault, or federates to the 1Password, Vault, Doppler, or Infisical you already run. What it adds: agents get time-boxed access, secrets inject below them, and values are redacted from everything they see. Here is what that covers and what it does not.
~/.claude/projects
and shipped upstream. ironrun redacts the value too. Defense in depth, not a replacement.ironrun is defense in depth, not a guarantee. A seatbelt, not an armored car. It composes with the controls you already trust (scoped tokens, read-only database users, a sandboxed agent) and adds the layer they miss: the secret value never enters the agent's environment or context, so it can't be logged, cached, or exfiltrated through it.
ironrun sits between your agent and the shell. If it runs shell commands, it works with ironrun.
Native MCP support gives your agent twelve tools with zero config: run sealed, request access, propose commands. Just ironrun init
and done.
Install it, run ironrun init
, and your agent is wired up. The policy, MCP config, and CLAUDE.md get written for you.
A single binary. macOS and Linux, arm64 and amd64. Nothing else to run.
$ curl -fsSL https://ironrun.dev/install.sh | bash
ironrun init detects your project, creates an encrypted dev environment, and writes the policy, MCP config, and agent instructions. Add your commands and secrets to the workspace.
$ cd your-project
$ ironrun init
- Created ironrun.yml
- Created encrypted environment dev
- Created .mcp.json
- Created CLAUDE.md
Your agent asks for access once; you approve in the TUI. Then it calls run_sealed instead of the shell. Secrets go in, redacted output comes back.
run_sealed("test")
exit_code: 0
stdout: "ok - key=[REDACTED]"
One YAML file. Secrets sealed below the agent. MIT licensed, forever.