ironcurtain

Why we included this project

Most teams building autonomous agents end up choosing between a sandbox so narrow the agent can't do real work, and handing it the same filesystem, credentials, and network access the user has. IronCurtain tries to break that trade-off by treating the agent as untrusted and enforcing policy at the runtime boundary instead of hoping the model behaves. You write a short plain-English constitution describing what the agent may and may not do, and the system compiles that into deterministic rules checked on every tool call. Each action is allowed, denied, or escalated to you for approval. Agent interactions flow through MCP servers, so the runtime can interpose on filesystem, git, and network operations without giving the model raw system access. It runs both its own built-in agent in a V8 isolate and external agents like Claude Code or Goose inside a network-isolated Docker container, which suits developers who already have a favorite agent CLI but want real enforcement. It is an early-stage research prototype, so expect evolving APIs and configuration formats rather than a settled production platform.