IronCurtain

What is IronCurtain?

IronCurtain is an open-source personal AI assistant and agent runtime created by Niels Provos, designed so an agent does not inherit all of your privileges. Instead of running with your full file, credential and network access, the agent writes TypeScript inside an isolated V8 sandbox, and that code can only issue typed calls that map to MCP tool calls. Every call passes through a trusted process that decides to allow, deny or escalate it to a human, and anything not explicitly permitted is denied. You write the rules as a short constitution in plain English, with no DSL, YAML or regex, and IronCurtain compiles it into enforceable policy. An optional auto-approver can accept escalations when your own trusted input clearly asked for the action. Built-in tool sets cover filesystem, Git, GitHub, web, Signal and Google services, and Claude Code can run in a Docker container under the same policy engine. The authors stress that the word secure is not absolute. There are no paid plans listed; it is open source.

Use cases

• Restrict what an AI agent may do
• Write agent security policy in plain English
• Sandbox autonomous coding agents
• Auto-approve routine safe agent actions
• Limit damage from prompt injection
• Run Claude Code in a policy-controlled container
• Audit every agent tool call

Who it's for

• AI agent developers
• Security researchers
• Security-minded engineers

Why use IronCurtain

• Plain-English rules are easier to write and review than hand-coded permission lists.
• Keeping the agent's privileges separate from yours limits what a single prompt injection can reach.
• Auto-approval based on your own typed instructions reduces approval prompts without opening everything up.
• The source is open, so a security team can inspect how decisions are made.

IronCurtain features

• Constitution written in plain English and compiled into policy
• Allow, deny or escalate decision for every tool call
• V8 isolated sandbox for agent-written TypeScript
• Docker mode with no network and credentials kept outside the container
• Auto-approver that relies on trusted user input
• Terminal multiplexer for running Claude Code under policy
• Tool sets for filesystem, Git, GitHub, web, Signal and Google
• Multi-agent workflows with human review gates
• Audit log of each decision and the rule behind it
• Standard, unmodified MCP servers

IronCurtain integrations

• Claude Code
• GitHub
• Signal
• Gmail
• Google Calendar
• Google Drive
• Docker
• Brave Search

How to get started with IronCurtain

1. Install IronCurtain with npx from the @provos/ironcurtain package on a machine you can test on.
2. Write a constitution that states in plain English what the agent may and may not do.
3. Let IronCurtain compile it into allow and escalate rules, with deny as the default.
4. Run your agent, or Claude Code in Docker mode, and let each tool call pass through the policy engine.
5. Approve or deny escalations, and review the audit log of decisions.

IronCurtain limitations

• The authors say the constitution and policy cannot guarantee nothing unintended will happen
• Early-stage project whose APIs and configuration may change
• You need to run and set it up yourself
• Model usage by your agent is billed by its provider

IronCurtain pricing

IronCurtain is open source, so you can use and self-host it for free.

Prices can change and may vary by country or exclude tax. Check the official pricing page.

IronCurtain alternatives

The main IronCurtain alternatives listed on Debuly are NeMo Guardrails, Guardrails AI, Agent Governance Toolkit, E2B, Prediction Guard and BlackVault. The table compares pricing and platforms; order is A–Z.

1. 

   Agent Governance Toolkit

   Microsoft's open-source toolkit for enforcing policy, identity, sandboxing and audit records on autonomous AI agents before they reach production.

   Developer platformsAutomation and agents
   Open sourceVisit Agent Governance Toolkit (official site)
2. 

   BlackVault

   Open-source credential firewall for AI agents that swaps real API keys for scoped proxy tokens with budgets, rate limits and a kill switch.

   Developer platformsAutomation and agents
   Open sourceVisit BlackVault (official site)
3. 

   E2B

   Cloud sandboxes where AI agents run code safely, with Python and JavaScript SDKs and per-second usage billing.

   Developer platformsAutomation and agentsCoding
   FreemiumVisit E2B (official site)
4. 

   Guardrails AI

   Open-source framework that wraps LLM apps with validators for PII, hallucination and policy checks, plus Snowglobe simulation testing.

   Developer platformsCodingAutomation and agents
   Open sourceVisit Guardrails AI (official site)
5. 

   NeMo Guardrails

   Open-source Python library from NVIDIA that adds programmable safety, topic and security rails between your app and an LLM.

   Developer platformsAutomation and agents
   Open sourceVisit NeMo Guardrails (official site)
6. 

   Prediction Guard

   Self-hosted control plane that governs AI agent actions with runtime controls, a supply chain registry and audit logs.

   Developer platformsAutomation and agents
   Contact salesVisit Prediction Guard (official site)

IronCurtain FAQ

Sources & verification

Facts on this page come from the official sources below, each with the date we read it. Written by Debuly; the vendor did not review this page.

Image credits

• Logo: from ironcurtain.dev · fetched 23 Oct 2026 · Vendor trademark, used only to identify the product; removed on request
• Cover: none collected yet, so a generated tile is shown.

Spot an error? Report an issue with this listing. We also remove a logo or image on the owner's request.