Redan - Secure agent execution

Why redan?

AI agents need API keys to be useful and sandboxes to be safe. Some agents ship built-in sandboxing, but each one does it differently. Redan provides a single, hardened execution layer that works with any agent: Claude Code, Pi, OpenCode, or whatever comes next.

Typical setup

Agent sees your API keys in plain text
Each agent has its own sandbox (or none at all)
No control over which hosts the agent contacts
Secrets end up in logs, error messages, LLM context

With redan

Agent sees placeholder tokens, never real secrets
One runtime for all agents, consistent policy
Default-deny networking with explicit allowlist
Responses scrubbed before the agent sees them

How it works

A microVM boots in under a second. All network traffic routes through a TLS MITM proxy on the host that injects and scrubs secrets.

🔒

VM isolation

Each session runs in a libkrun microVM with its own kernel. No shared filesystem, no shared memory with the host.

🔑

Secret injection

Secrets are injected into HTTP headers by the proxy. The guest never sees real values, only placeholders.

🌐

Default-deny network

No outbound connections unless you allow them. Wildcard patterns, private IP blocking, domain fronting protection.

📋

Audit trail

Every connection, injection, and scrub event is logged. Structured JSON-lines for compliance and debugging.

🔍

Discover mode

Don't know what hosts your agent needs? Run once with --discover and redan prints a suggested allowlist.

⚡

Fast boot

Sub-second VM startup via libkrun. No daemon, no background service. Single binary, runs inline.

Architecture

Everything between the agent and the internet is controlled by redan.

Guest VM (libkrun, <1s boot)
  │
  │  virtio-fs  (project dir, read-write)
  │  virtio-net (ethernet over unix socket)
  ▼
smoltcp (userspace TCP/IP on host)
  │
  ├── UDP :53   → synthetic DNS (no queries leave the host)
  ├── TCP :80   → rejected (HTTPS only)
  └── TCP :443  → TLS MITM proxy
        │
        ├── SNI extraction
        ├── ephemeral cert (per-session CA)
        ├── secret injection (headers only, host-allowlisted)
        ├── request forwarded to real upstream
        ├── response scrubbed of secret values
        └── streamed back to guest

Get started in 3 commands

Works with Claude Code out of the box. Bring your own agent too.

Terminal

# Generate config and devcontainer
redan init --claude

# Build the image
redan image import myproject --devcontainer .devcontainer/redan

# Run the agent
redan exec

Or configure manually with a redan.toml:

redan.toml

# Already have a Dockerfile?
image = "claude-code"
interactive = true

[network]
allow = ["api.anthropic.com", "*.npmjs.org"]

[secrets.ANTHROPIC_API_KEY]
value = "sk-ant-..."
hosts = ["api.anthropic.com"]

[mount.workspace]
source = "."

Open source

Redan is BSD-3-Clause licensed. The full proxy, VM lifecycle, secret providers (including Vault), and all security logic ship in the open core.

This is alpha software. It works end-to-end, from redan init through interactive Claude Code sessions with network policy enforcement, but has not been through an independent security audit. Read the security model.

Your agents run free.Your secrets stay put.