Coding agents at full speed. With full receipts.
Marshal runs inside your VPC. Every Space a developer opens and every Deputy that runs on its own lives in an isolated pod — full egress audit, credentials the agent never sees, and a policy plane you can change while it runs. You set the rules. You see every move.
- 100%
- EGRESS LOGGED
- <4ms
- NET OVERHEAD
- 0
- CREDS IN AGENT
agent@space-prod-1:~/workspace$ claude --dangerously-skip-permissions
✓ Connected · network profile: claude-code
● Migrating user_sessions to soft-delete
● Running tests… 312/312 pass
EGRESS INSPECTION · LIVE · ALLOW / PASSTHRU / DENY
FOR SECURITY & CISO
Every byte, every verb, every credential — logged.
FOR DEVELOPERS & CTO
Yolo, without the cold sweat.
FOR PLATFORM LEADS
One substrate. Every agent. Your VPC.
01 · The problem
Coding agents are the biggest productivity gain in a decade — and the largest unmanaged attack surface in your stack.
Your developers already turned on autonomous mode. Your security team is about to find out. The trade you have been offered — let agents run loose, or lock them out — is wrong on both sides, and the incidents have already started.
VELOCITY
“It deleted the production database. In nine seconds.”
A publicly-reported incident from a coding agent in 2025. It had psql because the developer did. Credentials sat in ~/.pgpass. Prompts were off. The backups went too.
Publicly reported · 2025
VISIBILITY
“We have no idea what data left the company.”
Most vendor-cloud agents proxy egress through the vendor’s own network. No per-request log you own, no rule to enforce, no domain you can revoke. 33 npm packages shipped live .env secrets last quarter.
Knostic research · Q1 2026
GOVERNANCE
“Just block it.”
The answer your security team is about to reach for — and it costs you the upside. Nubank reports 8–12× engineering efficiency from agents. Ban them and you forfeit that; allow them ungoverned and you own the breach.
Nubank, publicly reported · 2025
The runtime
One runtime. Two ways to run.
The same isolation, credential firewall, egress audit, and policy plane back both products. What changes is who starts the work and whether a human is watching.
Spaces
INTERACTIVEA developer opens a Space from their terminal, the browser, or the desktop app and drives a coding agent inside it. It feels local — the laptop is only a terminal; the work runs in an isolated pod in your VPC.
- Bring any of eight coding agents
- Ports and files bridged both ways
- Pause and resume with zero compute paused
Deputies
HEADLESSA Deputy is a standing, named worker owned somewhere in your org. It starts on an event, a schedule, a chat message, or another Deputy — never on a person being at a keyboard — and can pull a human into the run when it needs one.
- Triggered by event · schedule · chat · API
- Acts only through pre-declared, brokered grants
- Escalates into a live human takeover
02 · Control
Let the agent fly. Keep the steering wheel.
Autonomy and audited containment used to be a trade. Marshal removes it: every credential, every tool call, every byte of egress, and every database statement passes through a supervisor the agent cannot bypass.
Confidentiality
Agents never see your secrets.
The agent process runs with zero access to credentials. Tokens, keys, and SSH identities live in a supervisor-only vault and inject into tool subprocesses at the moment of invocation — never into the agent’s environment, files, or logs. A leak from the agent leaks nothing.
$ env | grep KEY
(empty)
$ cat .env
No such file
0 secrets reachable
injected per invocation
Block first
The agent doesn’t apologise. It justifies.
No “oops, I deleted the database” moments. Risky moves stop mid-execution by manifest — write a prod file, reach a new domain, request a credential — and the agent must reason about why before you approve or deny. The block comes first; the action waits on you.
claude-code attempted write infra/production.tf
rule: terraform.production · write requires justification
REASONING · AGENT
“The RDS migration needs db.r6g.xlarge for the 6-hour backfill — the current instance throttles on insert rate. Reverting after.”
The database
“Deleted the production database in nine seconds.” Not here.
Agent database connections route through the database control plane — the agent talks to a local socket and never holds the real credentials. Policy lands on the statement: allow SELECT, deny DROP. Postgres, MySQL, MongoDB, and Redis today, every statement audited.
prod=> SELECT count(*) FROM orders;
48213
prod=> DROP TABLE orders;
ERROR: marshal db-policy blocked statement
rule: prod.destructive · deny DROP
DB-POLICY.YAML · PROD-READONLY
Supply chain
Skills and MCPs, on a leash.
Skills and MCP servers expand what an agent can do — and they’re a supply chain you can’t see into. Marshal runs them in isolation: no credential access, no direct network, policy and egress scoped per Space. When a dependency turns up vulnerable, revoke that MCP server on the running Space, live — no restart, no waiting for the work to end.
SKILLS & MCPS · SPACE-PROD-1 · 4 INJECTED · 1 ALERT
github-mcp v2.1.0
scope: PRs · issues only
slack-mcp v1.4.3
scope: #eng-only
langchain-mcp v0.18.2
CVE-2026-1234 · vulnerable dep
security-policies v1.2
scope: markdown only
isolated · zero credential access · revoke live, no restart
HTTP(S) egress
every request, allow / passthrough / deny
Raw TCP
audited TCP proxy for non-HTTP protocols
Database wire
per-statement policy, credentials never exposed
Container builds
audited build egress on every fetch
Containment
Off the rails? Two real controls — without losing the work.
No detector that pretends to catch everything. Two controls a human can pull on any Space in the org.
Revoke a tool verb, an egress domain, or an MCP server on a running Space. The policy plane hot-reloads — no restart, no ending the work.
revoke mcp: github-mcp
allow POST github.com/repos
✓ applied · space-prod-1 · no restart
An admin can stop any Space in the org at once. The pod is torn down, but its volume persists — so the work resumes later, or gets inspected, without being destroyed.
POD
stopped
VOLUME
preserved
02 · CONTROL
Block the verb, not just the host.
Marshal inspects every tool invocation by verb and argument. Allow aws s3 cp. Deny aws s3 rm. Permit kubectl get. Block kubectl delete. The agent gets exactly the verbs you authorised — no more.
agent@space-prod-1:~/workspace$
aws s3 cp ./dist s3://acme-releases/ --recursive
✓ 14 files uploaded · 3.2 MB
aws s3 rm s3://acme-releases/ --recursive
✗ marshal: blocked by tool-policy
rule: aws.s3.destructive · deny
Deputies work while nobody is watching.
A deputy is a standing, named worker owned somewhere in your org. It starts on an event, a schedule, a chat message or another deputy — never on a person being at a terminal. It acts only through powers you declared in advance, every write is brokered control-plane side, and it knows how to pull a human into the run it is already standing in.
TRIGGER
event · schedule · chat · API
POWERS
pre-declared grants, brokered
ESCALATION
pulls a human into the live run
03 · Developer experience
Built for the way developers actually work.
The fastest things you do on your laptop — bridged ports, fast iteration, real collaboration — extended into the Space and across every agent you have running. Governance the developer never feels.
Bridged ports, both ways.
Local Postgres, Ollama, a staging tunnel — exposed into the Space. The agent’s dev server exposed back to your laptop. Both directions, automatically.
Ready on boot.
Pick a manifest, get a runtime — every toolchain pre-baked, every org tool already authenticated to the scopes your security team approved. Open the terminal, start typing.
Docker-in-Docker, per Space.
Opt a manifest into a private Docker daemon and the Space builds images and brings up Compose stacks on its own — the agent never touches your host socket, and every build fetch rides audited egress.
Preview the running app, share a link.
Point Marshal at any HTTP port in the Space and it surfaces a shareable preview URL with a review overlay — hand it to a designer or PM for eyes-on feedback without them cloning a thing.
Disconnect-proof.
Wi-Fi drops, the laptop sleeps, the train hits a tunnel — the work keeps running in your VPC. Reconnect and the agent picks up mid-thought, with zero re-typing.
One product owns both ends.
| Capability | Laptop & IDE agents | Vendor-cloud agents | Remote dev envs | Marshal |
|---|---|---|---|---|
| Runs inside your VPC — your cluster, your KMS | ||||
| Credentials never reach the agent process | ||||
| Per-request egress audit you own | ||||
| Per-verb tool policy (allow cp, deny rm) | ||||
| Governed headless agents, not just interactive | ||||
| Agent-agnostic — bring any coding agent |
Check = structurally yes · wave = partial, depends on the product · dash = not possible for that category — typical of each kind of tool; individual products vary.
Agent-agnostic
Bring your own agent. Or three.
Marshal is the substrate, not the agent. Eight coding agents run in interactive Spaces today — run one this morning, bake off three this afternoon. Your isolation, audit, and policy plane stay identical across all of them.
# swap the agent — same controls, same policy
agent: claude-code
toolchain: [node 22, go 1.24]
network: claude-code
# bake-off: change one field
agent: codex # or cursor · gemini-cli…
Claude Code
Anthropic
Codex
OpenAI
Gemini CLI
Cursor
Cursor
GitHub Copilot
GitHub
OpenCode
Open source
Windsurf
Codeium
Kiro
AWS
+ any CLI-callable agent via manifest.agent. Headless Deputies runs currently drive Claude Code and Gemini CLI.
06 · Architecture
Three planes. One trust boundary. Your VPC.
A daemon on the developer’s laptop bridges ports, files, and auth over a single HTTPS tunnel. A control plane in your cluster runs the work, RBAC, the policy plane, and the audit log. Each Space gets its own isolated pod where the agent runs sandboxed — nothing leaves the boundary unaudited, and Marshal never sees your traffic.
1 · YOUR LAPTOP
Where the developer sits
outside the boundary
native terminal · any shell · VS Code · Cursor
marshal daemon · ports / files / auth
browser terminal · xterm.js
2 · CONTROL PLANE
api + gateway
one per org
sessions · manifests
integration catalog
RBAC · SSO · policy plane
gateway · SSH / WS routing
audit log · → your storage
3 · SESSION RUNTIME
isolated pod · one per Space
agent process · own UID
no creds · no inbound · no direct network
SUPERVISOR · PID 1 · BROKERS EVERY MOVE
agent process
wants the network
EGRESS INSPECTION PLANE
the internet
only what policy allows
⤓ every verdict is tapped to the audit log in your storage. Database wire-protocol rides the database control plane; docker-build traffic rides audited build egress — same policy engine.
07 · Self-host first
Your cluster. Your VPC. Your audit trail.
Marshal deploys into your infrastructure — GKE on GCP, EKS on AWS, or single-node k3s on-prem. Postgres and Redis in your VPC, audit data in your storage, credentials in your KMS. We never see your traffic.
Live today across GCP and AWS — including Honeybook and VITRE — alongside further deployments we’re not able to name.
# receive a private Helm chart on accepted invitation
helm install marshal ./marshal-<release>.tgz \
--namespace marshal --create-namespace \
--set kms.vaultAddr=https://vault.your-co \
--set audit.sink=s3://your-bucket/audit \
-f values.yaml
# reachable at https://marshal.your-co.internal
08 · FAQ
Questions security teams actually ask.
The short version of what separates Marshal from a laptop, a vendor cloud, a remote dev env, or a local sandbox.
Bring AI agents inside. On your terms.
Marshal is in private beta, by invitation. Tell us about your cluster and the agents your team runs, and we’ll reach out when the next cohort opens — no pitch, no drip.
Not ready to apply? Get product updates instead — low volume, high signal, and a first look when each cohort opens.