> ## Documentation Index > Fetch the complete documentation index at: https://docs.ironrun.dev/llms.txt > Use this file to discover all available pages before exploring further. # ironrun — Sealed Command Execution for AI Coding Agents > ironrun injects secrets into commands while keeping them invisible to AI agents — your credentials never appear in chat transcripts or agent logs. ironrun is a local-first tool that lets AI coding agents run commands with live secrets — without ever seeing those secrets. It sits between the agent and every command it executes, injecting credentials at runtime and stripping them back out of all output before the agent reads the result. Set up a project and run your first sealed command in under five minutes Install ironrun on Linux, macOS, or Windows using curl, Go, or npm Understand the airgap model, output redaction, and trust architecture Connect ironrun to Claude Code, Cursor, or Codex via MCP ## The problem ironrun solves AI coding agents run shell commands on your machine, and some of those commands print secrets: ```bash theme={null} printenv # dumps every env var, including secrets cat .env # prints your local secrets file echo $STRIPE_SECRET_KEY # a normal debugging step docker inspect web # config blobs often contain credentials ``` When an agent runs one of these commands — even while legitimately debugging — the secret value lands in the chat transcript, the model's context window, and potentially the provider's logs. ironrun adds the missing piece: secrets flow **in** to commands, but never flow back **out** to the agent. ## How it works ``` Agent → run_sealed(argv) → ironrun → inject secrets → run command ↓ redact values from output ↓ Agent sees: exit_code=0, stdout="ok" Agent never sees: DATABASE_URL=postgres://... ``` Download the binary and add it to your PATH. ```bash theme={null} curl -fsSL https://ironrun.dev/install.sh -o /tmp/ironrun-install.sh bash /tmp/ironrun-install.sh ``` ironrun detects your stack, creates an encrypted environment, and wires up your AI agent automatically. ```bash theme={null} cd your-project ironrun setup ``` Launch Claude Code, Cursor, or Codex. The agent uses `run_sealed` instead of raw shell commands — and never sees secret values. ## Key capabilities Define approved commands and bind them to secret references in a single YAML file Pull secrets from 1Password, Doppler, Infisical, HashiCorp Vault, or local envfiles Grant an agent a two-hour revocable session for normal development work Block fork PRs from accessing production secrets automatically Value-blind MCP tools: run\_sealed, list\_commands, propose\_command, and more Tamper-evident hash-chained log of every sealed execution