Runabot: Zero-Trust Runtime for AI Agents#
Runabot confines AI agents, developer IDEs, and CI/CD jobs so they can be useful without receiving broad network access or real credentials; the same model also protects ordinary software development workflows from supply-chain malware.
It is designed for teams deploying human-in-the-loop coding agents, autonomous agents, MCP-connected assistants, developer workspaces, CI/CD jobs, and custom in-house workloads. The core idea is simple: a workload should not hold the keys to the systems it can affect.
What Runabot Provides#
- Zero exposure to real credentials: Workloads receive Runabot-issued proxy credentials, while real credentials stay outside the runtime. Credentials inside the container are useless to an attacker outside Runabot.
- Zero default internet access: Workloads run in Kubernetes behind strict network policy. External access is explicitly allowed by policy, not inherited from the cluster.
- Proxy-mediated tool access: Git, MCP, web, search, LLM, and package repository traffic is routed through controlled proxies that authenticate, authorize, inspect, and log requests before they reach external systems.
- Prompt-injection containment: Web and search responses are screened before entering the agent context, reducing the chance that hidden instructions turn into command execution or data exfiltration.
- Repository-scoped Git access: Coding agents can be limited to selected repositories and operations. A leaked proxy token is not a reusable GitHub, Azure DevOps, or GitLab credential.
- Traceable agent activity: Proxy boundaries create audit points for requests, responses, tool calls, and LLM inference traffic. OTLP-compatible traces also make Runabot a practical playground for debugging and improving autonomous agents.
- Self-service deployment: The same platform still provides web UI workflows, one-click deployments, backups, restore, SSH, CLI, and API access.
Why This Matters#
Modern agents interpret goals, choose tools, read untrusted content, and execute multi-step actions. That makes traditional “give the assistant a token and watch logs later” security too weak.
Anthropic’s Zero Trust for AI agents framework describes the shift: agent deployments should assume breach, verify every access path, and grant only the minimum capability required for the task.
Runabot turns that idea into runtime architecture:
| Risk | Runabot control |
|---|---|
| Prompt injection leaks a token | The token is valid only against a Runabot proxy and only for the assigned scope. |
| A supply-chain attack lands in the agent container | Real upstream credentials are not present in the container. |
| A coding agent tries to exfiltrate source code | Git access can be repository-scoped and read-only, with network egress denied by default. |
| An agent follows hidden instructions from a webpage | Runabot’s secure proxy addon inspects web and search content before proxying it to the agent. |
| Security teams need evidence | Proxy and LLM traffic is logged and exported as OTLP-compatible traces. |
Architecture Principles#
Runabot follows a few hard rules:
- Agents should not receive real upstream credentials.
- Network paths should not exist unless an operator or policy explicitly allows them.
- Every tool boundary should be an authorization and observability boundary.
- Human approval should manage policy, while routine enforcement stays automatic.
- Deployment should stay simple enough for self-service operation.
Focus#
Runabot provides strong workload confinement and mitigation of supply-chain attacks. It is a practical way to give software developers a secure runtime environment for IDEs such as Visual Studio Code, coding agents such as Claude Code, and autonomous agents such as OpenClaw and Hermes.
Ease of deployment matters. Runabot provides a web UI, one-click provisioning, backups, restore, CLI direction, and API foundation.
Community Model#
Agent and developer-workload security cannot be solved by a single generic SaaS integration catalogue. Every organization has its own legacy systems, internal APIs, MCP servers, policies, and audit requirements.
Runabot is designed as a club of member organizations that share a hardened zero-trust runtime foundation. Members can adapt the source code for their own internal systems and contribute those improvements back to the club, so other members do not have to rebuild the same controls.
The goal is collective defense: shared runtime security, shared integrations, and enough review capacity to keep improving faster than attackers can adapt.