provos/ironcurtain

npm install -g @provos/ironcurtain
From source: git clone https://github.com/provos/ironcurtain.git && cd ironcurtain && npm install

Usage

• •ironcurtain setup — first-start wizard (GitHub token, web search provider, model selection)
• •ironcurtain mux — recommended: full agent TUI (Claude Code/Goose) in a Docker container with per-tool policy mediation, inline escalation (a/d/w keys) and trusted input via Ctrl-A (auto-approves matching escalations)
• •ironcurtain start "..." / --agent builtin / --persona <name> — single-shot, local builtin REPL, or persona-scoped sessions
• •Customize policy: ironcurtain customize-policy (constitution) then ironcurtain compile-policy; run multi-agent workflows via ironcurtain workflow start vuln-discovery|design-and-code or ironcurtain daemon --web-ui

Key features

• ✓Constitution → deterministic policy pipeline: Annotate → Compile → Resolve Lists → Generate Scenarios → Verify & Repair, with content-hash caching and deny-by-default enforcement
• ✓Semantic interposition: every tool call passes through a policy engine (allow/deny/escalate); agent is untrusted (defends against prompt injection and multi-turn drift)
• ✓Two session modes: Builtin Agent (TypeScript in a V8 isolate) and Docker Agent Mode (external agents like Claude Code/Goose, TLS MITM proxy with host allowlist and fake-to-real key swap, validating registry proxy for npm/PyPI)
• ✓Six built-in MCP servers: Filesystem (14 tools), Git (28), Fetch (2), GitHub (41, requires PAT), Google Workspace (128, requires OAuth), Memory (5)
• ✓Personas (policy profiles with workspace + memory), cron daemon, Signal messaging transport for mobile approvals, web UI, and multi-agent workflow engine (vuln-discovery, design-and-code) with human review gates

Best for

Safety-critical autonomous agent work where prompt injection or multi-turn drift is a real threat — expressing natural-language security policy and enforcing it deterministically over MCP tool calls.

Caveats

• ⚠Research prototype: APIs, configuration formats, and architecture may change
• ⚠Requires Node.js 22, 24, or 26 (even-numbered lines only; Node 22 compiles isolated-vm from source and needs a C/C++ toolchain; odd lines like 23/25 are untested and flagged by doctor)
• ⚠Requires at least one LLM API key (ANTHROPIC_API_KEY, GOOGLE_GENERATIVE_AI_API_KEY, or OPENAI_API_KEY); GitHub MCP server needs a GitHub PAT; Google Workspace needs OAuth setup
• ⚠Docker strongly recommended for the strongest isolation (Docker Agent Mode); on macOS 26+ Apple silicon, Apple 'container' can be used as an alternative backend
• ⚠Known limitations: LLM compiler can misread constitution intent (review compiled-policy.json), V8 isolates are not OS-level virtualization, no outbound content inspection, escalation fatigue
• ⚠OS-level MCP sandboxing requires bubblewrap and socat; only one mux/escalation-listener can run at a time