ironrun - An encrypted workspace for AI agents

An encrypted workspace for humans and AI agents

Run agents.<br>Not your secrets.

Every AI agent runs inside your shell, wired straight to your real API keys, database URLs, and tokens. It doesn't forget what it reads, either. ironrun seals them in one encrypted workspace, hands the agent a time-boxed lease instead of the value, and redacts anything that slips into output. The agent finishes the job. It never sees the secret.

$ curl -fsSL https://ironrun.dev/install.sh | bash

Copy agent prompt

01<br>[ 01 / 07 ]&ensp;The Exposure

Your agent can read<br>every secret you've got.

Keys, database URLs, tokens: if it's in your environment, the agent can read it. And it doesn't forget.<br>Claude Code logs every tool call to ~/.claude/projects, argument by argument. A secret that passed through<br>one command is sitting in that file, in plaintext, right now.

2&times;<br>Commits co-authored by Claude Code leak secrets at roughly twice the rate of human-authored ones. AI-service credential leaks grew 81% in a single year.<br>GitGuardian &middot; State of Secrets Sprawl 2026

Without ironrun

# Agent runs your deploy script

$ ./deploy.sh --prod

# Your secrets hit stdout

STRIPE_SECRET=sk-live-...

AWS_SECRET=wJalrX...

# Now in the model's context.

# Logged to disk. Sent upstream. Permanent.

With ironrun

# Agent asks once; you approve in the TUI

$ ironrun run deploy

Deploying to prod...

using key=[REDACTED]

exit_code: 0

# Pulled from your workspace, injected below the agent.

# Never in its context. Nothing to leak.

02<br>[ 02 / 07 ]&ensp;Mechanism

One encrypted workspace.<br>The value never reaches the model.

Drop a YAML file in your project. ironrun handles the vault, the subprocess, and the output.<br>Your agent calls one tool. It gets back exit code, timing, and redacted output. Never the secret values that ran inside.

the loop

Vaultsecrets, encrypted

&rarr;<br>Env setsdev &middot; staging &middot; prod

&rarr;<br>Agent asksrequest access

&uarr;

&darr;

Redacted outputwhat the agent sees

&larr;<br>Sealed runsecrets injected below

&larr;<br>You approve oncein the TUI

ironrun &middot; access request

agentclaude-code

wantsrun_sealed&ensp;db-migrate

envdevttl30m

[ a ] approve[ r ] reject

Vault

Secrets live in ironrun's local encrypted vault: AES-256-GCM, on your machine. Or federate to 1Password, Vault, Doppler, or Infisical. Pulled at exec time. Never written to disk.

version: "2"<br>environment_set: active<br>commands:<br>- id: deploy<br>secrets: [STRIPE_SECRET, AWS_SECRET]

Execute

Runs with a clean environment and no shell. Nothing to inject through. Only the command you named runs.

commands:<br>- id: deploy<br>argv: [./deploy.sh, --prod]<br>ttl: 30s<br>no_network: true

Redact

Every byte of output runs through a rolling pattern match before the agent sees it. A secret shows up in stdout? Gone before it leaves the process.

# What the agent receives:<br>exit_code: 0<br>duration_ms: 191<br>stdout: "Deployed. key=[REDACTED]"<br># secret values: [REDACTED]

03<br>[ 03 / 07 ]&ensp;Security Model

Eight layers because one isn't enough.

ironrun assumes your agent is compromised. Every layer blocks exfiltration on its own.<br>Fail one, the others hold.

Threat: assume the agent is compromised

Encrypted Vault<br>Secrets sit in an AES-256-GCM vault at rest, on your machine. Nothing in plaintext on disk.

Scoped Leases<br>Agents get time-boxed, command-scoped access you approve once. Leases auto-expire and revoke on demand.

Shell Denial<br>Commands run directly, never through a shell. No backticks, $(), or pipes to abuse.

Env Sanitize<br>Parent environment stripped. Only declared variables injected. The subprocess starts clean.

Binary Allowlist<br>Only named executables can run. Everything else denied. No curl to arbitrary endpoints.

Rolling Redactor<br>Streaming match on stdout/stderr. Secrets replaced before buffering. Catches partial leaks across chunks.

TTL Enforcement<br>Commands have a time-to-live. Exceed it, the process is killed. No hanging shells leaking in the background.

Value-Blind Audit<br>A hash-chained log records command names and redaction counts, never secret values. Tamper-evident.

Secrets: sealed, never in the agent's context

04<br>[ 04 / 07 ]&ensp;Architecture

The wall is structural.

The agent asks for access, you approve a time-boxed lease, and only then does a<br>sealed process ever touch a secret. Secrets exist only inside that process.<br>Never serialized. Never logged. Never in the agent's context. This isn't a<br>wrapper around your commands. It's a wall between your secrets and the model.

Agent

ironrun exec

&rarr;

Lease

Human approves

&rarr;

Policy

Validate + Allow

&rarr;

Sealed Zone

Secrets + Process

&rarr;

Redactor

Strip + Return

&rarr;

Agent

Safe output

05<br>[ 05 / 07 ]&ensp;Objections

Yes, it's a vault.<br>Built for the agent boundary.

ironrun stores secrets in a local AES-256-GCM vault, or federates to the 1Password, Vault, Doppler, or Infisical you already run.<br>What it adds: agents get...