decoyrail

Endpoint firewall for AI agents

Your coding agent works with decoy credentials.
Real secrets never enter its environment.

Decoyrail is a single binary that runs Claude Code, Codex CLI, or any coding agent behind a local proxy. The agent holds decoys. The proxy swaps in the real secret only for that secret's approved destination, blocks everything else, and raises an alarm the moment a decoy heads anywhere it should not. If the agent is tricked into leaking a key, the key it leaks works nowhere.

Install for macOS Get started in 5 minutes

Watch it catch an exfiltration

A prompt injection tells the agent to send its AWS key somewhere it should not go. The key the agent holds is a decoy, so the request is blocked and the attempt lands in the log:

A decoy AWS key sent to an unapproved host is blocked, and decoyrail log records the exfiltration attempt

The whole setup is one command

# Run your agent behind Decoyrail. With a Claude subscription this is
# everything: default-deny egress, an audit log, and every
# credential-looking env var in your terminal replaced with a decoy.
$ decoyrail run -- claude

# In a second terminal, watch every decision live.
$ decoyrail log -t
allow     api.anthropic.com POST /v1/messages
tripwire  decoy 'aws' seen toward evil.example.com: blocked

# Only if you pay per token with an API key: vault it. The agent then
# sees a decoy; api.anthropic.com receives the real key.
$ decoyrail vault add --name anthropic --env ANTHROPIC_API_KEY --location bearer

No vault setup is needed for the common case. decoyrail run spots credential-looking variables in your terminal (AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, and so on) and hands the agent decoys automatically:

decoyrail run replaces sensitive env vars with decoys before launching the agent

Decoys, not redaction

Real secrets stay encrypted on disk and exist only inside the proxy. The agent, its logs, its prompts, and its crash dumps can only ever contain fakes that look real (sk-ant-…, ghp_…, AKIA…), so stock SDKs accept them without any special-casing.

The swap is narrow

The real secret goes out only when the host, path, method, and location all match what you bound it to, and only over verified TLS. The proxy never follows a redirect, so a secret cannot be bounced somewhere the policy never looked at.

Stolen decoys tell on the thief

Every decoy is a honeytoken. If one shows up outside its binding, even base64, hex, or percent-encoded, the request is blocked and the alarm is logged. You find out the moment anyone tries to use it.

What's in the box

Default-deny egress policy

Nothing leaves unless a rule allows it, and the rule that allows a destination also says which secrets it releases. A starter pack covers what coding agents need.

TLS interception done carefully

A CA minted on your device, per-host certificates, and a fresh, fully verified connection upstream. Enterprise internal CAs are additive, never a bypass.

Streaming stays fast

Token streams pass through untouched. Bounded responses are scanned for echoed real secrets.

An audit log you can trust

Append-only and hash-chained. decoyrail log --verify catches edits, deletions, and truncation.

Spend metering & budget

Exact per-model token counts, a monthly budget, and a kill switch that denies requests once the budget is spent.

Offline by design

No account, no server, no telemetry. Nothing about your traffic ever reaches us.

An honest threat model

Today Decoyrail runs as your user and guards the network path your agent is configured through. That covers accidental secret leaks, prompt-injected exfiltration, off-policy egress, and audit-history tampering. It is not yet a boundary against hostile code running as you: a same-user process can still read ~/.decoyrail off disk or edit the policy (the privileged system mode on the roadmap closes that). An agent that sidesteps the proxy gains nothing: its requests fail, and the decoys it carries work nowhere. For a security product, the limits are part of the product: read the full threat model.

Install

v0.3.1 · macOS · Apple Silicon

# install with Homebrew
brew install decoyrail-team/tap/decoyrail

# first run (with a Claude subscription, this is everything)
decoyrail ca install
decoyrail run -- claude

# only if you use an API key instead of a subscription:
decoyrail vault add --name anthropic --env ANTHROPIC_API_KEY --location bearer

No Homebrew? Download decoyrail-v0.3.1-aarch64-apple-darwin.tar.gz from the GitHub release (sha256 cfcaf70446c4d6f0c5825e8942d8051a884fff0b2bf76f0b6de6617de12b989a) and put decoyrail on your PATH:

curl -LO https://github.com/decoyrail-team/decoyrail/releases/download/v0.3.1/decoyrail-v0.3.1-aarch64-apple-darwin.tar.gz
shasum -a 256 -c <(echo "cfcaf70446c4d6f0c5825e8942d8051a884fff0b2bf76f0b6de6617de12b989a  decoyrail-v0.3.1-aarch64-apple-darwin.tar.gz")
tar xzf decoyrail-v0.3.1-aarch64-apple-darwin.tar.gz
mkdir -p ~/.local/bin && mv decoyrail-v0.3.1-aarch64-apple-darwin/decoyrail ~/.local/bin/

This is a pre-release build, not yet codesigned or notarized. Homebrew and curl installs don't trip Gatekeeper; a browser download will be quarantined (clear it with xattr -d com.apple.quarantine decoyrail). Free for individual use; the core is source-available under FSL-1.1-ALv2 so you can audit the binary that intercepts your TLS.