Huge launch. Self-hosted agent systems are the future, and egress enforcement is what makes them safe.
iron-proxy is the egress layer inside centaur. We went deep on the hard parts like OAuth brokering, HMAC signing, and Postgres MITM for RLS.
Open Sourcing Centaur: Multiplayer, self-hosted, secure agents for Slack.
Centaur has been transforming how @paradigm and @tempo invest, build and research.
Now you can run it yourself on infrastructure you control. Instructions below.
This is really cool to see. Self-hosted sandboxes + default-deny egress is the future. Most iron-proxy users are already running agents in their own VPCs; now they can run Claude Managed Agents there too.
Live from Code with Claude London: we're launching self-hosted sandboxes (public beta) and MCP tunnels (research preview) in Claude Managed Agents.
Run agents inside your own perimeter, with your security controls applied by default.
iron-proxy now supports MCP inspection and policy enforcement. Whitelist exactly the tools your agent needs, and audit every call.
This is where other tools like Squid fall short. They understand URLs, but not the protocols agents are actually speaking.
Pin versions, set a minimum release age, and run an egress proxy in front of anything running potentially untrusted code. Do this now, before this happens again next week.
🚨 BREAKING: 84 TanStack npm packages were compromised in an ongoing Mini Shai-Hulud supply chain attack, adding suspected CI credential-stealing malware.
Socket flagged every malicious version within six minutes of publication. This is a developing story.
@alexellisuk Thanks! I love Squid but it's limiting with agents. Very impressed with Slicer btw... the CA injection + network config makes it really easy to set up egress proxies.
New in iron-proxy v0.15: the judge transform. Give your config a prompt, and it'll evaluate matching requests against it via an LLM. Support both Anthropic and OpenAI backends.
Default-deny still applies: the judge can only reject.
Release notes: https://t.co/NUx9OUC1We
5/ This matters especially for coding agents. Even if the agent gets prompt-injected into posting a "comment" full of secrets, the comment still has to pass the judge.
If your agent can reach GitHub, today's a good day to secure it.
https://t.co/86wmD5kQwS
1/ Malware continues to dump secrets on GitHub. Today's Bitwarden CLI backdoor is just the latest of many examples.
Hostname allowlists can't tell good GitHub traffic from bad. You need a filter that actually understands the GitHub API. Here's how.
4/ At this point everything left looks legitimate. As a final layer of defense, add a judge transform to read the request body in flight and classify it against a policy you write in English: