1/ iron-proxy v0.53.0 is live. Please upgrade now, as it includes fixes for two security issues: a contained agent could bypass MCP tool allowlists (fixed in v0.50.0) or enforced Postgres RLS (fixed in v0.53.0).
2/ Advisories with affected versions, workarounds, and detection guidance:
MCP: github.com/paradigmxyz/iron-…
RLS: github.com/paradigmxyz/iron-…
Today’s the day: I've joined @paradigm to lead Centaur. First up, launch 2.0. Next, we grow the team.
Announcing Centaur 2.0!
Centaur is frontier, agentic infrastructure that you own. Centaur is like Claude Tag, but open source and on steroids.
Centaur 2.0 can connect to everything you have access to, and can reason over it next to where you work, either in Slack, Discord, Teams or in your local Codex or Claude Code via an MCP.
But context isn't useful if it can be accessed by anyone, so we rebuilt Centaur from the ground up for security. Centaur obviously doesn't have access to secrets because we're leveraging egress proxies.
Centaur 2.0 takes that a step further enabling administrators to configure who can access what from where. This means that Centaur can have access to private information that you normally wouldn't feel comfortable giving it access to (e.g. DMs or sensitive channels and docs) but only expose it to authorized principals.
It also means you can add Centaur to external channels and leverage it as a virtual colleague that doesn't live only in your Slack, for example, but also your Slack Connect channels! This is extremely powerful as we start moving to a world where agents cross organizational boundaries.
Also in case anyone's wondering, yes we rewrote it in Rust! Centaur is now way way more stable at durably executing threads, and its workflow engine is now based on Absurd.
We have been operating Centaur since January, officially launched and Open Sourced it in May, and now we're full speed towards making it the #1 open source agentic infrastructure.
To succeed at that, I'm thrilled to welcome @mslipper to the @paradigm team who will be leading all our Applied AI work, while continuing to maintain and extend Iron Proxy as the leading secure secret access for agents. Welcome Matt, it's an honor after all these years of knowing you!
Read the full blogpost below, and apply to join our team!
The best open source software comes out of tooling a company depends on: Centaur embodies the best of that. People at paradigm and @tempo use Centaur every day along with many others. Today it gets better: Permissions are now first-class in the runtime, and MCP support means Centaur goes wherever you work.
This is really cool to see. Self-hosted sandboxes + default-deny egress is the future. Most iron-proxy users are already running agents in their own VPCs; now they can run Claude Managed Agents there too.
Live from Code with Claude London: we're launching self-hosted sandboxes (public beta) and MCP tunnels (research preview) in Claude Managed Agents.
Run agents inside your own perimeter, with your security controls applied by default.
3
801
iron-proxy now supports MCP inspection and policy enforcement. Whitelist exactly the tools your agent needs, and audit every call.
This is where other tools like Squid fall short. They understand URLs, but not the protocols agents are actually speaking.
This is available in iron-proxy v0.23.0+. Release notes here: github.com/ironsh/iron-proxy…
1
307
Pin versions, set a minimum release age, and run an egress proxy in front of anything running potentially untrusted code. Do this now, before this happens again next week.
🚨 BREAKING: 84 TanStack npm packages were compromised in an ongoing Mini Shai-Hulud supply chain attack, adding suspected CI credential-stealing malware.
Socket flagged every malicious version within six minutes of publication. This is a developing story.
1
1
487
Seeing more and more folks opting to bring their own compute rather than using sandboxes. Boring EC2 instances / k8s pods often work just fine.
2
256
1/ Malware continues to dump secrets on GitHub. Today's Bitwarden CLI backdoor is just the latest of many examples.
Hostname allowlists can't tell good GitHub traffic from bad. You need a filter that actually understands the GitHub API. Here's how.
New in iron-proxy v0.15: the judge transform. Give your config a prompt, and it'll evaluate matching requests against it via an LLM. Support both Anthropic and OpenAI backends.
Default-deny still applies: the judge can only reject.
Release notes: github.com/ironsh/iron-proxy…
Hat tip to @brexhq's CrabTrap, which inspired this design: github.com/brexhq/CrabTrap
1
172
IMO putting secrets in env vars is an antipattern. The Vercel thing makes that clear. Workloads shouldn't have secrets at all. Keep them in a vault instead and have an egress proxy inject them on the way out. This will seem obvious in a year.
iron-proxy v0.12.0 adds AWS SSM Parameter Store support.
We added Secrets Manager on Monday. We're adding SSM today. Supports SecureString decryption, JSON key extraction from parameter values, and TTL-based refresh without restarting the proxy. Get secure, proxied credentials wherever you run your stuff.
Release notes: github.com/ironsh/iron-proxy…
2
356
This is a big deal. It's how we think about agent execution at iron[.]sh too. Treat sandboxes as interchangeable, then do all the security-critical stuff like secret management outside. iron-proxy supports this natively.
Build long-running agents with more control over agent execution.
New capabilities in the Agents SDK:
• Run agents in controlled sandboxes
• Inspect and customize the open-source harness
• Control when memories are created and where they’re stored
4
870
iron-proxy v0.10.0 is out! We've added support for resolving secrets directly from AWS Secrets Manager. Store your credentials in ASM, and the proxy injects them in at the network layer.
This is the direction: stop handing secrets to untrusted code. Let it call APIs without giving it keys.
Release notes: github.com/ironsh/iron-proxy…
Cloudflare agrees: you need an egress proxy between untrusted workloads and the internet. We've been building exactly this, in the open, at iron.sh.
Cloudflare Sandboxes is now GA.
Agents need more than prompt windows. They need terminals, interpreters, live environments, and secure secrets
Now they can: pull code, install repos, run tests, debug failures, iterate
The engineering loop that actually ships code.
blog.cloudflare.com/sandbox-…
Shipped SOCKS5 and HTTP CONNECT support to iron-proxy today. You get the same egress policy, but now tools that expect a traditional proxy interface just work.
More protection for more workloads.
Release notes: github.com/ironsh/iron-proxy…
Last week I demoed locking down GitHub Actions egress with iron-proxy. By default your CI runner can talk to anything. Any dependency or build step can quietly exfiltrate data, and you’d never know.
I’ve packaged that demo into a GitHub Marketplace action. Drop it into your pipeline with four lines of YAML and get real control and observability over your outbound traffic.
v0.7.0 also adds OTLP export, so you can pipe your egress audit logs into your existing tooling and run detection, alerting, or forensics on top.
Get it here: github.com/marketplace/actio…
Demo below ↓
We open-sourced iron-proxy yesterday: a default-deny egress proxy for untrusted workloads.
CI is a natural place for this. GitHub Actions runners have unrestricted outbound network access by default. Every dependency, every post-install script, every agent tool call can reach any endpoint on the internet.
iron-proxy sits between the runner and the network. Allowlist what should talk to the internet. Log everything. Block everything else.
Repo: github.com/ironsh/actions-de…
Walkthrough 👇
We're open-sourcing more of our stack: iron-proxy, a default-deny egress proxy for untrusted workloads.
It's been a bad month for supply chain security. Trivy, KICS, LiteLLM, and Axios all followed the same playbook: compromise a package, harvest env vars, exfiltrate secrets to a C2 server. Your CI runner, your agents, and your sandboxes all have real keys.
iron-proxy sits between your workload and the internet. Workloads get proxy tokens. iron-proxy swaps in real credentials at the network boundary. If a compromised dependency exfiltrates your API key, it gets a token that's worthless outside the proxy. It's how we secure our VMs at iron[.]sh.
The only way out is making sure there are no real secrets to steal.
GitHub: github.com/ironsh/iron-proxy
