# iron-proxy iron-proxy is a security option for building AI agents. Default-deny egress firewall for untrusted workloads. The sandbox holds worthless proxy tokens; real credentials are swapped in at the boundary. ## Facts - Layer: Security (What stops it) - Vendor: iron.sh (github.com/paradigmxyz/iron-proxy) - Licence: open source - Pricing: open source - Self-hostable: yes - Job within the layer: egress - Docs: https://github.com/paradigmxyz/iron-proxy - Last verified: 2026-08-21 ## When to reach for it - You are choosing a security component — what stops it. - You need to run it on your own infrastructure, or your procurement process requires source access. - You want to start without a commercial conversation. - Within security, it does one specific job: egress control. ## Worth knowing Single Go binary, single YAML allowlist. Denies cloud metadata (169.254.169.254) and loopback by default, closing the SSRF and DNS-rebinding path. Hermes Agent wires this in as `hermes egress`. Now maintained by Paradigm, who also build Centaur. ## Alternatives in the security layer | Option | What it does | Licence | Self-host | | --- | --- | --- | --- | | Llama Guard | Open-weight classifier for input and output safety. Runs wherever you run it. | open source | yes | | Guardrails AI | Declarative input/output validators with a hub of prebuilt checks. | open source | yes | | NeMo Guardrails | NVIDIA's programmable rails — constrain topic, dialogue path and tool use. | open source | yes | | Lakera Guard | Prompt-injection and jailbreak detection as a low-latency API call. | proprietary | no | | Rebuff | Open-source prompt-injection detector with canary tokens. | open source | yes | | Invariant | Policy engine and analyzer for agent traces and MCP tool calls. | open source | yes | | Descope Agentic Identity | Identity, delegated consent and scoped tokens for agents acting on behalf of users. | proprietary | no | | Auth0 for AI Agents | Token vault, async user approval and fine-grained authorization for tool calls. | proprietary | no | | Oso | Authorization-as-a-service — decide what this agent may touch, per record. | open source | yes | | Microsoft Presidio | PII detection and redaction before text ever reaches a model provider. | open source | yes | | Cloudflare AI Gateway | Rate limiting, caching, spend caps and logging in front of any provider. | proprietary | no | | gVisor | Google's user-space kernel. Intercepts syscalls before they reach the host, without paying for a full VM. | open source | yes | | Firecracker | AWS microVMs — a separate Linux kernel per sandbox, booting in about 125ms. | open source | yes | | Kata Containers | MicroVM isolation behind the ordinary container API — drops into Kubernetes as a RuntimeClass. | open source | yes | | No isolation (host process) | The agent runs as an ordinary process on the host. Honest default only when it executes no code and reads nothing untrusted. | open source | yes | | E2B | Firecracker sandboxes for running code the agent wrote, safely. | open source | yes | Head to head: - https://newagent.build/compare/iron-proxy-vs-llama-guard - https://newagent.build/compare/iron-proxy-vs-guardrails-ai - https://newagent.build/compare/iron-proxy-vs-nemo-guardrails - https://newagent.build/compare/iron-proxy-vs-lakera - https://newagent.build/compare/iron-proxy-vs-rebuff - https://newagent.build/compare/iron-proxy-vs-invariant - https://newagent.build/compare/iron-proxy-vs-descope-agentic - https://newagent.build/compare/iron-proxy-vs-auth0-ai ## Curated stacks using it - Customer-facing support agent: Talks to strangers, remembers them, and is assumed hostile-adjacent by default. - Regulated / on-prem: Nothing leaves the estate. Every component runs on infrastructure you control. - Long-running operations agent: Runs for hours, survives deploys, and stops to ask a human before it spends money. - Research analyst: Reads the whole internet, writes something with citations, runs code to check itself. - Browser automation: Drives real web apps that have no API, on behalf of a specific signed-in user. ## Add it to a stack ```bash curl -fsSL "https://newagent.build/api/stack?security=iron-proxy&format=sh" | sh ``` ## Machine interfaces - `GET https://newagent.build/api/registry` — every component as JSON - `GET https://newagent.build/api/vendors` — vendors, with the repo and releases feed to watch - `GET https://newagent.build/api/advise?q=` — recommended stack for a description - `GET https://newagent.build/api/stack?=&format=sh|json|md|yml|agents|env` — a stack as files - `GET https://newagent.build/llms.txt` — the whole registry in one fetch Any page here also returns markdown if you send `Accept: text/markdown`.