How it works

The workload never sees a real token.

Treat every agent as compromised: it reads untrusted content, sees private data and talks to the network. Runabot gives it no reusable secrets and only approved destinations.

Launch App Read the zero-trust runtime guide
Credential swap
Workload

Untrusted agent, IDE or CI job

GITHUB_TOKEN=rb_scoped_7f3a…
Runabot proxy

Checks policy, swaps the credential, writes the trace

External system

Git, MCP, web, search, LLM, packages

Authorization: Bearer ghp_real…

What a compromised agent can still do.

Runabot does not rely on every workload behaving well. Each control limits what an attacker gains from a successful prompt injection or a malicious package.

Use a scoped token, not steal a real one Real upstream credentials stay outside the workload. The workload receives a scoped Runabot credential that only works through the proxy.
Reach approved destinations only Outbound traffic is denied by default. External systems are reachable only through approved paths and policies.
Use tools through the proxy Git, MCP, web, search, package and LLM access is authenticated, authorized, inspected and logged.
Damage a runtime you can replace Backups and reproducible environments let you replace a compromised runtime instead of cleaning up a polluted laptop.

Agents, IDEs and CI jobs run behind the same proxy.

The controls that make autonomous agents safer also reduce credential theft and data exfiltration in everyday software development.

Autonomous and human-guided agents Give agents the tools they need without broad credentials, open internet access or unmanaged side channels.
IDE and SSH workspaces Run Visual Studio Code, a shell and coding assistants in a controlled environment instead of on a laptop full of long-lived secrets.
CI/CD and package builds Constrain dependency install scripts, release jobs and build tools with scoped proxy credentials and reviewed egress.

Every request the agent makes is in the trace.

The proxy writes logs and OTLP-compatible traces for audit, debugging and evaluation. You see how an agent used its tools, where it got stuck and which responses changed its next step.

Read about security features
00.000sagent.planok
00.184sproxy.git.fetchscoped
01.026sproxy.web.searchscreened
01.447segress.unknown-hostblocked
02.101sllm.responserecorded