Your developers have already turned on yolo mode. Your security team is about to find out. The trade you've been making — let them run loose, or lock them out — is wrong on both sides. The incidents have already started.
This isn't hypothetical. It's a logged incident from a coding agent in 2025. The agent had psql because the developer had it. Credentials were in ~/.pgpass, where they've lived for years. Permission prompts were off because they kill flow. Backups were wiped too. The post-mortem found nothing unusual about the setup — that's the point. Every laptop with a coding agent on it tonight is one prompt away from the same five-figure incident.
This is what a CISO sounds like when their org adopted coding agents without infrastructure for them. Cursor, Devin, Codespaces — every popular agent proxies egress through the vendor's own network. There's no per-request log you can subpoena, no rule you can enforce, no domain you can revoke. 33 npm packages were caught shipping live .env secrets last quarter — the agents that wrote them transmitted those credentials somewhere. You'll learn about the next breach when the notification arrives.
That's the answer your CISO is about to propose. It's also wrong. Coding agents deliver real, measured productivity wins — Nubank reports 8–12× efficiency, 20× cost savings. Block everything: you lose a generational advantage. Allow everything as-is: you own the next breach. There has to be a third option — one where your CISO becomes an enabler, not a blocker — without losing control for a second. That's what we built.
Regain security control while freeing your developers to run faster. Unattended autonomy and audited containment used to be a trade. Marshal removes it.
The agent process runs with zero access to credentials. Tokens, API keys, and SSH identities are held in a supervisor-only vault and injected into tool subprocesses at invocation time — never into the agent's environment, never into its filesystem. A leak from the agent leaks nothing.
Anomalous DNS exfil. A new MITM-flagged domain. A credential request you didn't expect. Quarantine the session — runtime freezes mid-execution, network goes dark, credentials revoke, and the entire state is preserved for forensics. Sub-second. Reversible. Auditable.
Run agents in unattended --dangerously-skip-permissions mode without the cold-sweat moment. Every tool call routes through the supervisor; every byte of egress routes through the proxy; every credential request is gated. The blast radius is bounded by manifest, not by attention.
No “oops, sorry I deleted the database” moments. Risky moves get blocked mid-execution by manifest. The agent has to reason about why it needs the action — and you decide. Write to a prod file, fetch from a new domain, request a credential: each one stops, the agent submits a justification, you approve or deny. The agent earns the action — or it doesn't happen.
Mid-session policy isn't only about domains. Marshal inspects every tool invocation by verb and argument. Allow aws s3 cp. Deny aws s3 rm. Permit kubectl get. Block kubectl delete. The agent gets exactly the verbs you authorized — no more.
Skills (markdown injected) and MCP servers (tools the agent calls) expand what your agent can do. They're also a supply-chain you can't see into. Marshal injects them in isolation — they never touch your credentials, never reach your filesystem, never speak directly to your network. Scope each skill/MCP per session. When a CVE lands in a dependency, revoke it across every running session in under a second. The capability stops working before the next request fires.
The fastest thing you do on your laptop — bridged ports, fast iteration, real collaboration — extended into the space and across every agent you have running.
Marshal is bought by the team — and the buyers don't agree on what matters. Developers want frictionless sessions; platform leads want declarative control; security wants proof. Each gets what they need from the same system.
Other platforms either live on your laptop (no audit), or own the pod (no laptop bridge), or run sandboxes via SDK (not for interactive sessions). Marshal does all three — plus the policy plane in the middle.
✓ shipped · ~ partial / behind feature flag · ✗ not available · based on public docs as of May 2026
Marshal is the substrate — not the agent. Run Claude Code today, Codex tomorrow, Cursor on the experiments branch. Pick, swap, evaluate, change your mind. Your isolation, your audit, your policy plane stay the same. Security never blinks. Developers stay at the speed of light.
manifest.agent — anything CLI-callableA daemon on your developer's laptop bridges ports, files, and auth into the session. A control plane in your cluster runs sessions, manifests, policy, and the audit log. An isolated runtime per session holds the agent — and routes every byte of egress through the Marshal MITM Proxy. We deploy all three into your infrastructure. Marshal never sees your traffic.
Marshal deploys into your infrastructure — AWS, GCP, Azure, on-prem, or air-gapped. Postgres and Redis in your VPC. Audit data in your storage. Credentials in your KMS. We never see your traffic.
We're onboarding a small cohort of security-first engineering orgs each quarter. If you want AI coding agents inside your stack — without bringing the risk in with them — let's talk.
Your CISO becomes an enabler, not a blocker — without losing control for a second. Marshal is in private beta with security-first engineering orgs putting AI agents in production today.