Sealed secret execution for AI agents

Ironrun, a new open-source tool, seals AI agents' access to secrets like API keys and database URLs by running them in an encrypted workspace with time-boxed leases and redacting secrets from output. The tool stores secrets in an AES-256-GCM vault locally or federates to 1Password, Vault, Doppler, or Infisical, and assumes the agent is compromised, blocking exfiltration through multiple layers. Ironrun is available as a single binary for macOS and Linux under the MIT license.

Every AI agent runs inside your shell, wired straight to your real API keys, database URLs, and tokens. It doesn't forget what it reads, either. ironrun seals them in one encrypted workspace, hands the agent a time-boxed lease instead of the value, and redacts anything that slips into output. The agent finishes the job. It never sees the secret. Keys, database URLs, tokens: if it's in your environment, the agent can read it. And it doesn't forget. Claude Code logs every tool call to ~/.claude/projects, argument by argument. A secret that passed through one command is sitting in that file, in plaintext, right now. Drop a YAML file in your project. ironrun handles the vault, the subprocess, and the output. Your agent calls one tool. It gets back exit code, timing, and redacted output. Never the secret values that ran inside. Secrets live in ironrun's local encrypted vault: AES-256-GCM, on your machine. Or federate to 1Password, Vault, Doppler, or Infisical. Pulled at exec time. Never written to disk. version: "2" environment set: active commands: - id: deploy secrets: STRIPE SECRET, AWS SECRET Runs with a clean environment and no shell. Nothing to inject through. Only the command you named runs. commands: - id: deploy argv: ./deploy.sh, --prod ttl: 30s no network: true Every byte of output runs through a rolling pattern match before the agent sees it. A secret shows up in stdout? Gone before it leaves the process. What the agent receives: exit code: 0 duration ms: 191 stdout: "Deployed. key= REDACTED " secret values: REDACTED ironrun assumes your agent is compromised. Every layer blocks exfiltration on its own. Fail one, the others hold. The agent asks for access, you approve a time-boxed lease, and only then does a sealed process ever touch a secret. Secrets exist only inside that process. Never serialized. Never logged. Never in the agent's context. This isn't a wrapper around your commands. It's a wall between your secrets and the model. ironrun stores secrets in a local AES-256-GCM vault, or federates to the 1Password, Vault, Doppler, or Infisical you already run. What it adds: agents get time-boxed access, secrets inject below them, and values are redacted from everything they see. Here is what that covers and what it does not. ~/.claude/projects and shipped upstream. ironrun redacts the value too. Defense in depth, not a replacement.ironrun is defense in depth, not a guarantee . A seatbelt, not an armored car. It composes with the controls you already trust scoped tokens, read-only database users, a sandboxed agent and adds the layer they miss: the secret value never enters the agent's environment or context, so it can't be logged, cached, or exfiltrated through it. ironrun sits between your agent and the shell. If it runs shell commands, it works with ironrun. Native MCP support gives your agent twelve tools with zero config: run sealed, request access, propose commands. Just ironrun init and done. Install it, run ironrun init , and your agent is wired up. The policy, MCP config, and CLAUDE.md get written for you. A single binary. macOS and Linux, arm64 and amd64. Nothing else to run. bash verifies the checksum before running $ curl -fsSL https://ironrun.dev/install.sh | bash ironrun init detects your project, creates an encrypted dev environment, and writes the policy, MCP config, and agent instructions. Add your commands and secrets to the workspace. bash $ cd your-project $ ironrun init - Created ironrun.yml - Created encrypted environment dev - Created .mcp.json - Created CLAUDE.md Your agent asks for access once; you approve in the TUI. Then it calls run sealed instead of the shell. Secrets go in, redacted output comes back. Agent calls the MCP tool: run sealed "test" exit code: 0 stdout: "ok - key= REDACTED " One YAML file. Secrets sealed below the agent. MIT licensed, forever.