PRIVATE BETA · BY INVITATION

Coding agents at full speed. With full receipts.

Marshal runs inside your VPC. Every Space a developer opens and every Deputy that runs on its own lives in an isolated pod — full egress audit, credentials the agent never sees, and a policy plane you can change while it runs. You set the rules. You see every move.

100%
EGRESS LOGGED
<4ms
NET OVERHEAD
0
CREDS IN AGENT
space-prod-1 · mar-9f2ainspection: healthy

agent@space-prod-1:~/workspace$ claude --dangerously-skip-permissions

✓ Connected · network profile: claude-code

● Migrating user_sessions to soft-delete

● Running tests… 312/312 pass

EGRESS INSPECTION · LIVE · ALLOW / PASSTHRU / DENY

ALLOWGET registry-1.docker.io/v2/
ALLOWGET github.com/acme/base.git
PASSTHRUCONNECT api.stripe.com:443
DENYPOST telemetry.pkg-cdn.net/collect

FOR SECURITY & CISO

Every byte, every verb, every credential — logged.

FOR DEVELOPERS & CTO

Yolo, without the cold sweat.

FOR PLATFORM LEADS

One substrate. Every agent. Your VPC.

01 · The problem

Coding agents are the biggest productivity gain in a decade — and the largest unmanaged attack surface in your stack.

Your developers already turned on autonomous mode. Your security team is about to find out. The trade you have been offered — let agents run loose, or lock them out — is wrong on both sides, and the incidents have already started.

VELOCITY

“It deleted the production database. In nine seconds.”

A publicly-reported incident from a coding agent in 2025. It had psql because the developer did. Credentials sat in ~/.pgpass. Prompts were off. The backups went too.

Publicly reported · 2025

VISIBILITY

“We have no idea what data left the company.”

Most vendor-cloud agents proxy egress through the vendor’s own network. No per-request log you own, no rule to enforce, no domain you can revoke. 33 npm packages shipped live .env secrets last quarter.

Knostic research · Q1 2026

GOVERNANCE

“Just block it.”

The answer your security team is about to reach for — and it costs you the upside. Nubank reports 8–12× engineering efficiency from agents. Ban them and you forfeit that; allow them ungoverned and you own the breach.

Nubank, publicly reported · 2025

The runtime

One runtime. Two ways to run.

The same isolation, credential firewall, egress audit, and policy plane back both products. What changes is who starts the work and whether a human is watching.

Spaces

INTERACTIVE

A developer opens a Space from their terminal, the browser, or the desktop app and drives a coding agent inside it. It feels local — the laptop is only a terminal; the work runs in an isolated pod in your VPC.

  • Bring any of eight coding agents
  • Ports and files bridged both ways
  • Pause and resume with zero compute paused

Deputies

HEADLESS

A Deputy is a standing, named worker owned somewhere in your org. It starts on an event, a schedule, a chat message, or another Deputy — never on a person being at a keyboard — and can pull a human into the run when it needs one.

  • Triggered by event · schedule · chat · API
  • Acts only through pre-declared, brokered grants
  • Escalates into a live human takeover

02 · Control

Let the agent fly. Keep the steering wheel.

Autonomy and audited containment used to be a trade. Marshal removes it: every credential, every tool call, every byte of egress, and every database statement passes through a supervisor the agent cannot bypass.

Confidentiality

Agents never see your secrets.

The agent process runs with zero access to credentials. Tokens, keys, and SSH identities live in a supervisor-only vault and inject into tool subprocesses at the moment of invocation — never into the agent’s environment, files, or logs. A leak from the agent leaks nothing.

WHAT THE AGENT SEES

$ env | grep KEY

(empty)

$ cat .env

No such file

0 secrets reachable

SUPERVISOR VAULT
GITHUB_TOKEN → git, gh
AWS_ACCESS_KEY → aws (cp)
KUBECONFIG → kubectl (get)
SSH_PRIVATE_KEY → ssh, scp

injected per invocation

Block first

The agent doesn’t apologise. It justifies.

No “oops, I deleted the database” moments. Risky moves stop mid-execution by manifest — write a prod file, reach a new domain, request a credential — and the agent must reason about why before you approve or deny. The block comes first; the action waits on you.

BLOCKED · req_8f3a2114:02:11

claude-code attempted write infra/production.tf

rule: terraform.production · write requires justification

REASONING · AGENT

“The RDS migration needs db.r6g.xlarge for the 6-hour backfill — the current instance throttles on insert rate. Reverting after.”

Approve onceDenyAsk

The database

“Deleted the production database in nine seconds.” Not here.

Agent database connections route through the database control plane — the agent talks to a local socket and never holds the real credentials. Policy lands on the statement: allow SELECT, deny DROP. Postgres, MySQL, MongoDB, and Redis today, every statement audited.

psql · database control plane · live

prod=> SELECT count(*) FROM orders;

48213

prod=> DROP TABLE orders;

ERROR: marshal db-policy blocked statement

rule: prod.destructive · deny DROP

DB-POLICY.YAML · PROD-READONLY

allow SELECT · GET · KEYS
deny DROP · ALTER · FLUSHDB
allow UPDATE … WHERE
deny DELETE (no WHERE) · TRUNCATE

Supply chain

Skills and MCPs, on a leash.

Skills and MCP servers expand what an agent can do — and they’re a supply chain you can’t see into. Marshal runs them in isolation: no credential access, no direct network, policy and egress scoped per Space. When a dependency turns up vulnerable, revoke that MCP server on the running Space, live — no restart, no waiting for the work to end.

SKILLS & MCPS · SPACE-PROD-1 · 4 INJECTED · 1 ALERT

MCP

github-mcp v2.1.0

scope: PRs · issues only

MCP

slack-mcp v1.4.3

scope: #eng-only

MCP

langchain-mcp v0.18.2

CVE-2026-1234 · vulnerable dep

Revoke live
SKILL

security-policies v1.2

scope: markdown only

isolated · zero credential access · revoke live, no restart

ONE POLICY ENGINE · EVERY PATH OUT OF THE POD

HTTP(S) egress

every request, allow / passthrough / deny

Raw TCP

audited TCP proxy for non-HTTP protocols

Database wire

per-statement policy, credentials never exposed

Container builds

audited build egress on every fetch

Containment

Off the rails? Two real controls — without losing the work.

No detector that pretends to catch everything. Two controls a human can pull on any Space in the org.

revoke a rule, live

Revoke a tool verb, an egress domain, or an MCP server on a running Space. The policy plane hot-reloads — no restart, no ending the work.

revoke mcp: github-mcp

allow POST github.com/repos

✓ applied · space-prod-1 · no restart

stop any Space, instantly

An admin can stop any Space in the org at once. The pod is torn down, but its volume persists — so the work resumes later, or gets inspected, without being destroyed.

POD

stopped

VOLUME

preserved

02 · CONTROL

Block the verb, not just the host.

Marshal inspects every tool invocation by verb and argument. Allow aws s3 cp. Deny aws s3 rm. Permit kubectl get. Block kubectl delete. The agent gets exactly the verbs you authorised — no more.

agent terminal · livesupervised

agent@space-prod-1:~/workspace$

aws s3 cp ./dist s3://acme-releases/ --recursive

✓ 14 files uploaded · 3.2 MB

aws s3 rm s3://acme-releases/ --recursive

✗ marshal: blocked by tool-policy

rule: aws.s3.destructive · deny

Deputies work while nobody is watching.

A deputy is a standing, named worker owned somewhere in your org. It starts on an event, a schedule, a chat message or another deputy — never on a person being at a terminal. It acts only through powers you declared in advance, every write is brokered control-plane side, and it knows how to pull a human into the run it is already standing in.

deputy · standing workerwatching

TRIGGER

event · schedule · chat · API

POWERS

pre-declared grants, brokered

ESCALATION

pulls a human into the live run

03 · Developer experience

Built for the way developers actually work.

The fastest things you do on your laptop — bridged ports, fast iteration, real collaboration — extended into the Space and across every agent you have running. Governance the developer never feels.

Bridged ports, both ways.

Local Postgres, Ollama, a staging tunnel — exposed into the Space. The agent’s dev server exposed back to your laptop. Both directions, automatically.

postgres · :5432
ollama · :11434
dev server · :3000

Ready on boot.

Pick a manifest, get a runtime — every toolchain pre-baked, every org tool already authenticated to the scopes your security team approved. Open the terminal, start typing.

go 1.24python 3.13node 22rust 1.84

Docker-in-Docker, per Space.

Opt a manifest into a private Docker daemon and the Space builds images and brings up Compose stacks on its own — the agent never touches your host socket, and every build fetch rides audited egress.

docker builddocker composeisolated daemon

Preview the running app, share a link.

Point Marshal at any HTTP port in the Space and it surfaces a shareable preview URL with a review overlay — hand it to a designer or PM for eyes-on feedback without them cloning a thing.

$ marshal-agent review-preview --port 3000
preview URL · shareable
2 reviewers · 5 annotations

Disconnect-proof.

Wi-Fi drops, the laptop sleeps, the train hits a tunnel — the work keeps running in your VPC. Reconnect and the agent picks up mid-thought, with zero re-typing.

● disconnected (Wi-Fi)
⟳ reconnecting…
tunnel restored · 0.4s

One product owns both ends.

CapabilityLaptop & IDE agentsVendor-cloud agentsRemote dev envsMarshal
Runs inside your VPC — your cluster, your KMS
Credentials never reach the agent process
Per-request egress audit you own
Per-verb tool policy (allow cp, deny rm)
Governed headless agents, not just interactive
Agent-agnostic — bring any coding agent

Check = structurally yes · wave = partial, depends on the product · dash = not possible for that category — typical of each kind of tool; individual products vary.

Agent-agnostic

Bring your own agent. Or three.

Marshal is the substrate, not the agent. Eight coding agents run in interactive Spaces today — run one this morning, bake off three this afternoon. Your isolation, audit, and policy plane stay identical across all of them.

AGENT-MANIFEST.YAML

# swap the agent — same controls, same policy

agent: claude-code

toolchain: [node 22, go 1.24]

network: claude-code

# bake-off: change one field

agent: codex # or cursor · gemini-cli…

CC

Claude Code

Anthropic

Cx

Codex

OpenAI

Gm

Gemini CLI

Google

Cu

Cursor

Cursor

Co

GitHub Copilot

GitHub

Oc

OpenCode

Open source

Ws

Windsurf

Codeium

Ki

Kiro

AWS

+ any CLI-callable agent via manifest.agent. Headless Deputies runs currently drive Claude Code and Gemini CLI.

06 · Architecture

Three planes. One trust boundary. Your VPC.

A daemon on the developer’s laptop bridges ports, files, and auth over a single HTTPS tunnel. A control plane in your cluster runs the work, RBAC, the policy plane, and the audit log. Each Space gets its own isolated pod where the agent runs sandboxed — nothing leaves the boundary unaudited, and Marshal never sees your traffic.

1 · YOUR LAPTOP

Where the developer sits

outside the boundary

native terminal · any shell · VS Code · Cursor

marshal daemon · ports / files / auth

browser terminal · xterm.js

HTTPS / WSS
YOUR VPC · YOUR CLUSTER · YOUR KMS

2 · CONTROL PLANE

api + gateway

one per org

sessions · manifests

integration catalog

RBAC · SSO · policy plane

gateway · SSH / WS routing

audit log · → your storage

3 · SESSION RUNTIME

isolated pod · one per Space

agent process · own UID

no creds · no inbound · no direct network

SUPERVISOR · PID 1 · BROKERS EVERY MOVE

egress inspection plane · all HTTP(S)
database control plane · per-statement SQL
audited build egress · container builds
audited TCP proxy · non-HTTP protocols
tool guardrail · per-verb policy
MCP isolation · policy + egress
credential injector · at request time
network policy engine · allow · passthrough · deny
audit pipeline · → control plane
credential vault · root-only
PII redaction · response bytessoon
EGRESS PATH · EVERY BYTE THROUGH THE PROXY

agent process

wants the network

EGRESS INSPECTION PLANE

allowinspect + logpassthroughhost-only + logdenyblock + log

the internet

only what policy allows

every verdict is tapped to the audit log in your storage. Database wire-protocol rides the database control plane; docker-build traffic rides audited build egress — same policy engine.

HTTPS ONLYNo port opening, no SSH gateways, no inbound firewall holes. VPN- and Zero-Trust-friendly (Tailscale · Twingate · Cloudflare Access).

07 · Self-host first

Your cluster. Your VPC. Your audit trail.

Marshal deploys into your infrastructure — GKE on GCP, EKS on AWS, or single-node k3s on-prem. Postgres and Redis in your VPC, audit data in your storage, credentials in your KMS. We never see your traffic.

BYO KMS · VaultSSO / SCIM · OIDCGKE · EKS · k3s

Live today across GCP and AWS — including Honeybook and VITRE — alongside further deployments we’re not able to name.

Read the deployment docs →

DEPLOY.SH

# receive a private Helm chart on accepted invitation

helm install marshal ./marshal-<release>.tgz \

--namespace marshal --create-namespace \

--set kms.vaultAddr=https://vault.your-co \

--set audit.sink=s3://your-bucket/audit \

-f values.yaml

# reachable at https://marshal.your-co.internal

08 · FAQ

Questions security teams actually ask.

The short version of what separates Marshal from a laptop, a vendor cloud, a remote dev env, or a local sandbox.

A local microVM sandbox protects one laptop from one agent — real isolation, but it stops at the machine’s edge, and most only intercept HTTP: the agent still holds the real database password, still speaks raw TCP to Redis, still runs docker builds with unchecked egress. Marshal goes further. The database wire protocol is intercepted at the statement level (the agent connects to a local socket and never holds real DB credentials); raw TCP rides an audited TCP proxy and container builds ride audited build egress; and credential injection happens at request time to the declared destination only, so a misrouted credential is blocked and logged, not just swapped. On top of that it is the org-wide layer: work runs in your VPC on your cluster, every byte of egress is governed, and any Space can be stopped by an admin or have its policy revoked live.

Bring AI agents inside. On your terms.

Marshal is in private beta, by invitation. Tell us about your cluster and the agents your team runs, and we’ll reach out when the next cohort opens — no pitch, no drip.

Not ready to apply? Get product updates instead — low volume, high signal, and a first look when each cohort opens.

Request access

Tell us about your cluster and the agents your team runs. Only your email is required.