IronCurtain — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Track policy-language and runtime behavior while preserving its research-prototype label

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Security boundary for autonomous agents that mediates every external effect through policy-checked MCP calls.

What we know

Research-prototype agent runtime that compiles a human-readable constitution into deterministic allow/deny/escalate policy.

Maintenance / activity evidence

Observed Oct 2, 2026 (UTC)chore(deps-dev): bump the development group across 1 directory with 1…

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Activity source · commits ↗Activity source · releases ↗

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
External effects are mediated by deterministic MCP policy; unmatched calls deny by default. Writes: Filesystem mutations; Git pushes/pulls; PR creation; API/network actions through MCP.
Provider/service credentials as configured.
Sensitive access: Filesystem, Git credentials, Service tokens

It intentionally gives agents useful authority while trying to contain it; misconfigured policy or a research-prototype defect can still have material impact.

Security source · repository notice ↗Security source · policy file ↗

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

611 repository stars

Stars observed Sep 25, 2026.

Do not overwrite existing reviewed stars/download metrics with nulls from this enrichment batch.

All limitations / Review context

What effect controls and documented limitations still apply to the MCP runtime?

The official README labels the project a research prototype and asks readers to treat security claims skeptically; this is a material uncertainty to disclose, but the bounded review found no separate public-tracking blocker.

It intentionally gives agents useful authority while trying to contain it; misconfigured policy or a research-prototype defect can still have material impact.
External effects are mediated by deterministic MCP policy; unmatched calls deny by default.
Provider/service credentials as configured.
Agent code runs in V8 isolation or container mode; configured services receive intended traffic.
Reviewed write actions: Filesystem mutations; Git pushes/pulls; PR creation; API/network actions through MCP
Sensitive access: Filesystem, Git credentials, Service tokens
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
The official README identifies this as a research prototype; no independent security audit or runtime evaluation was performed.
No independent runtime, installation, or comprehensive security audit was performed.
No installation, runtime, client matrix, or complete tool-contract audit was performed in this review.
Explicitly labeled an early-stage research prototype.
Policy quality still depends on compilation and operator configuration.
Node 25 is unsupported; Node 24/26 are the tested lines.

Original activity observations

2026-10-02T01:46:13Z: chore(deps-dev): bump the development group across 1 directory with 1…

Technical identity

github.com/provos/ironcurtain

Exact implementation source: https://github.com/provos/ironcurtain ↗
Reviewed resource type: Host
Repository identity: provos/ironcurtain
Package identity: npm:@provos/ironcurtain

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 7, 2026

GitHub repository ↗
provos/ironcurtain
Recorded repository material and project history.
Includes references whose attribution is not established.

Setup · Watchlist

Host / Desktop app setup

Publisher instructions.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Download / install
Publisher instructions
IronCurtain is an agent harness with policy enforcement, not a MCP server to install in Claude.
publisher documented step · Publisher instructions
npm install -g @provos/ironcurtain
publisher documented step · Publisher instructions
ironcurtain setup
publisher documented step · Publisher instructions
ironcurtain mux
Configure application / integrations
MCP100 setup guide
Requires Node 24 or 26 and a provider API key. Run ironcurtain setup before ironcurtain mux; mux is an agent host/policy workflow, not an stdio MCP server.
Check connection
Suggested check
Check ironcurtain --help and inspect wizard output; avoid executing an agent as an installation smoke test.
Disconnect / uninstall / revoke
MCP100 setup guide
Stop `ironcurtain mux` and managed agent sessions. If the globally installed IronCurtain CLI is no longer needed, `npm uninstall -g @provos/ironcurtain`. Keep ~/.ironcurtain policy/audit data unless separately approved.
Client unregistration, program uninstall, persistent-data deletion, and credential revocation must be treated separately.
Package / application uninstall · matching installation environment · MCP100 composed guide
npm uninstall -g @provos/ironcurtain

Official Documentation & Sources

What it does

Research-prototype agent runtime that compiles a human-readable constitution into deterministic allow/deny/escalate policy.

Capability: Security & Testing
Resource type: Host
Industry: Cybersecurity
Best fit: Security boundary for autonomous agents that mediates every external effect through policy-checked MCP calls.

Representative uses

Run coding/automation agents in V8 or Docker isolation
Mediate filesystem/Git/API MCP calls
Require approval for mutations such as pushes and PR creation
Audit and constrain autonomous workflows

Limitations

Explicitly labeled an early-stage research prototype.
Policy quality still depends on compilation and operator configuration.
Node 25 is unsupported; Node 24/26 are the tested lines.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Provider/service credentials as configured.
Permissions: External effects are mediated by deterministic MCP policy; unmatched calls deny by default.
Data handling: Agent code runs in V8 isolation or container mode; configured services receive intended traffic.
Cost: usage_based
Risk and cautions: It intentionally gives agents useful authority while trying to contain it; misconfigured policy or a research-prototype defect can still have material impact.

Access scope and cautions

Write actions: Filesystem mutations Git pushes/pulls PR creation API/network actions through MCP
Sensitive access: Filesystem Git credentials Service tokens
Risk level: high

FAQ

Based on reviewed evidence as of 2026-10-07. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Run coding/automation agents in V8 or Docker isolation; Mediate filesystem/Git/API MCP calls; Require approval for mutations such as pushes and PR creation; Audit and constrain autonomous workflows.

What setup and authentication are documented?

A complete connection procedure is not verified. Recorded transport: local_mcp_mediation. Client notes: Run `ironcurtain setup`; `ironcurtain mux` is the recommended interactive path. These facts do not supply missing installation commands, credentials or a verified authentication procedure. Authentication: LLM-provider credentials plus optional service credentials configured during setup.

Can it modify data or perform write operations?

Documented write actions include: Filesystem mutations; Git pushes/pulls; PR creation; API/network actions through MCP. Recorded permission boundary: External effects are mediated by deterministic MCP policy; unmatched calls deny by default.

What data-handling boundary should I consider?

Agent code runs in V8 isolation or container mode; configured services receive intended traffic. Recorded sensitive-access context: Filesystem; Git credentials; Service tokens.

What limitations and risks should I check before use?

It intentionally gives agents useful authority while trying to contain it; misconfigured policy or a research-prototype defect can still have material impact. Explicitly labeled an early-stage research prototype. Policy quality still depends on compilation and operator configuration. Node 25 is unsupported; Node 24/26 are the tested lines. The official README identifies this as a research prototype; no independent security audit or runtime evaluation was performed. No independent runtime, installation, or comprehensive security audit was performed.

What cost model is recorded?

The reviewed cost model is usage based. This classification does not establish current prices, quotas or the cost of every downstream operation. Check the applicable service terms before authorizing paid actions.

Is this an official MCP?

provos is listed as Community implementation in MCP100’s current evidence.