iron-proxy

Why it's ranked here

The design answers a real agent problem: a prompt-injected agent can only leak a placeholder token, because the real key is added after the request leaves the sandbox. The code backs that pitch with specifics. Cloud metadata addresses and loopback are refused by default even for allowed hosts, managed deployments refuse traffic until their first config arrives, and MCP calls are checked on every POST whatever content type the client declares. It is Apache 2.0 licensed, ships as one binary or Docker image, and publishes a private disclosure address with a PGP key. A narrow tool, defended in depth, for a gap its README says most teams cannot see.

What's good

Secrets work in two modes. Inject mode adds the header itself, so the client sends nothing. Replace mode swaps a placeholder and can reject any request that lacks it, which stops a workload from slipping in a different credential. Header names keep their exact casing on the wire, which matters for vendors that reject the normalised form. The allowlist has a warn mode that logs would-be blocks without breaking traffic, a sensible way to roll rules out. The MCP policy goes past blocking calls: it limits tools by argument values and strips disallowed tools from the list the agent sees, including on streaming responses.

Tradeoffs

Full inspection means every client container must trust a CA whose private key sits on the proxy. The no-CA mode sees only hostnames, so credential swapping has nothing to act on. For stronger enforcement than DNS redirection, the README itself recommends adding firewall rules. Behind a corporate upstream proxy, the address deny list checks that proxy rather than the final target, and raw tunnels still dial directly; the example config says so. Postgres protection breaks unless PgBouncer runs in session mode. Request bodies buffer to 1 MiB by default, and a larger MCP call is refused. In managed mode, audit logs default to the vendor's hosted ingest service.

How to use it well

Fits teams running CI jobs or coding agents in containers who want an allowlist and credential isolation without writing Squid ACLs or Envoy filters. Start from the bundled Docker Compose demo, then run the allowlist in warn mode against real traffic before enforcing. Use replace mode with the reject-if-missing flag for every key an agent touches, and add firewall rules so a workload cannot skip the DNS redirect by dialing an IP directly. It controls outbound traffic only, by its own description; isolating what the job does inside its container is a separate problem, and domains you mark as passthrough bypass the proxy entirely.

Observed

License

Apache License 2.0

Language

Go (module declares go 1.26.1)

Distribution

Single binary; Docker images on Docker Hub; prebuilt binaries for Linux and macOS on amd64 and arm64; buildable from source with go build

Configuration

One YAML file passed with -config, with IRON_* environment variable overrides

Interfaces

DNS server, HTTP/HTTPS proxy, optional CONNECT/SOCKS5 tunnel listener, optional Postgres listener, metrics endpoint, optional management HTTP API

TLS modes

mitm (default, clients must trust a supplied CA) or sni-only (hostname only, no CA, no TLS termination)

Secret sources

Environment variables, AWS Secrets Manager, AWS SSM Parameter Store, 1Password, 1Password Connect

Default upstream deny list

Cloud instance metadata addresses and loopback, applied even to allowlisted hosts

MCP policy

Per-server tool allowlist with argument constraints; disallowed tools filtered from tool listings

Security reporting

Private email disclosure with a PGP key, per SECURITY.md

Integration test targets

egress-rules.yaml allowlists AWS, GCP, 1Password, Anthropic and OpenAI endpoints for integration tests