Matthew Slipper @mslipper

Building https://t.co/0pucqh9KLy San Jose, California Joined June 2009

Tweets

228
Followers

2K
Following

337
Likes

661

Matthew Slipper @mslipper

4 weeks ago

@GrahamAnd3rson Glad you like it!

0 0 2 117 0

View Details

Huge launch. Self-hosted agent systems are the future, and egress enforcement is what makes them safe. iron-proxy is the egress layer inside centaur. We went deep on the hard parts like OAuth brokering, HMAC signing, and Postgres MITM for RLS.

Georgios Konstantopoulos @gakonst

a month ago

Open Sourcing Centaur: Multiplayer, self-hosted, secure agents for Slack. Centaur has been transforming how @paradigm and @tempo invest, build and research. Now you can run it yourself on infrastructure you control. Instructions below.

101 113 1K 627K 1K

1 1 16 2K 5

View Details

Matthew Slipper @mslipper

a month ago

This is really cool to see. Self-hosted sandboxes + default-deny egress is the future. Most iron-proxy users are already running agents in their own VPCs; now they can run Claude Managed Agents there too.

Claude @claudeai

a month ago

Live from Code with Claude London: we're launching self-hosted sandboxes (public beta) and MCP tunnels (research preview) in Claude Managed Agents. Run agents inside your own perimeter, with your security controls applied by default.

402 625 8K 2.4M 4K

0 0 1 303 1

View Details

Matthew Slipper @mslipper

2 months ago

@jjacky You don’t! Inject them at the network so the agent never gets the secret. We’re building this at iron.sh.

1 0 1 1K 4

View Details

Matthew Slipper @mslipper

2 months ago

This is available in iron-proxy v0.23.0+. Release notes here: github.com/ironsh/iron-pr…

0 0 0 197 0

View Details

Matthew Slipper @mslipper

2 months ago

iron-proxy now supports MCP inspection and policy enforcement. Whitelist exactly the tools your agent needs, and audit every call. This is where other tools like Squid fall short. They understand URLs, but not the protocols agents are actually speaking.

2 4 24 2K 8

View Details

Matthew Slipper @mslipper

2 months ago

Pin versions, set a minimum release age, and run an egress proxy in front of anything running potentially untrusted code. Do this now, before this happens again next week.

Socket @SocketSecurity

2 months ago

🚨 BREAKING: 84 TanStack npm packages were compromised in an ongoing Mini Shai-Hulud supply chain attack, adding suspected CI credential-stealing malware. Socket flagged every malicious version within six minutes of publication. This is a developing story.

69 365 2K 832K 499

1 0 0 261 1

View Details

Matthew Slipper @mslipper

2 months ago

@FUCORY @AFDudley0 Good take except for the Ruby hate

0 0 2 179 0

View Details

Matthew Slipper @mslipper

2 months ago

Seeing more and more folks opting to bring their own compute rather than using sandboxes. Boring EC2 instances / k8s pods often work just fine.

0 0 1 156 0

View Details

Matthew Slipper @mslipper

2 months ago

x.com/i/article/2051…

0 0 1 122 0

View Details

Matthew Slipper @mslipper

2 months ago

The deletions will continue until egress control improves

JER @lifeof_jer

2 months ago

x.com/i/article/2048…

1K 1K 5K 7.2M 6K

1 0 0 326 1

View Details

Matthew Slipper @mslipper

2 months ago

@alexellisuk Thanks! I love Squid but it's limiting with agents. Very impressed with Slicer btw... the CA injection + network config makes it really easy to set up egress proxies.

0 0 0 63 0

View Details

Matthew Slipper @mslipper

2 months ago

New in iron-proxy v0.15: the judge transform. Give your config a prompt, and it'll evaluate matching requests against it via an LLM. Support both Anthropic and OpenAI backends. Default-deny still applies: the judge can only reject. Release notes: github.com/ironsh/iron-pr…

2 0 3 520 2

View Details

Matthew Slipper @mslipper

2 months ago

@derekdfulton @utpalnadiger You probably could but I opted to remove it instead. 70% of boot was systemd; the rest was kernel init.

0 0 1 46 0

View Details

Matthew Slipper @mslipper

2 months ago

5/ This matters especially for coding agents. Even if the agent gets prompt-injected into posting a "comment" full of secrets, the comment still has to pass the judge. If your agent can reach GitHub, today's a good day to secure it. iron.sh

0 0 0 110 0

View Details

Matthew Slipper @mslipper

2 months ago

4/ At this point everything left looks legitimate. As a final layer of defense, add a judge transform to read the request body in flight and classify it against a policy you write in English:

1 0 1 128 0

View Details

Matthew Slipper @mslipper

2 months ago

1/ Malware continues to dump secrets on GitHub. Today's Bitwarden CLI backdoor is just the latest of many examples. Hostname allowlists can't tell good GitHub traffic from bad. You need a filter that actually understands the GitHub API. Here's how.