From 97035ad8920361066a678e7e8855a0d6a9f6d48f Mon Sep 17 00:00:00 2001 From: Paavo Pokkinen Date: Wed, 26 Aug 2026 08:14:55 +0300 Subject: [PATCH 1/3] docs(readme): add comparison with related tools Readers kept asking how Airlock differs from credential proxies like Infisical Agent Vault. The new "How Airlock compares" section answers that with a feature table limited to local, open-source tools someone would actually pick between (claw-wrap, fnox MCP, Infisical Agent Vault, nono), and relegates commercial identity gateways and SaaS OAuth layers to a one-paragraph pointer since they don't broker local CLIs at all. claw-wrap turned out to be the closest existing project (same daemon/socket/exec shape); the table makes explicit that Airlock's remaining differentiators are the OS sandbox on the spawned tool and automatic multi-encoding output redaction. --- README.md | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/README.md b/README.md index 3aa81da..94ceae1 100644 --- a/README.md +++ b/README.md @@ -55,6 +55,26 @@ Airlock is one layer of a defense-in-depth stack: 3. **Airlock** — credential isolation at runtime: secrets in memory, injected per tool, output redacted. 4. **Agent harness sandbox** — `airlock run`, Claude Code's `--sandbox`, Docker, nsjail, bubblewrap. Without it, the agent could read the daemon's memory or connect to the socket directly. +## How Airlock compares + +Most tools in this space are **HTTP proxies**: the agent sends a placeholder token, the proxy swaps in the real one on the wire. That works for API calls but can't broker a credential a CLI reads from its environment (`gh`, `gcloud`, `kubectl`, `tofu`, `git` signing). Airlock works at the **process layer** instead: it spawns the tool itself, sandboxed, with the secret injected, and redacts the output. + +| | Airlock | [claw-wrap](https://github.com/dedene/claw-wrap) | [fnox MCP](https://fnox.jdx.dev/guide/mcp.html) | [Infisical Agent Vault](https://github.com/Infisical/agent-vault) | [nono](https://github.com/nolabs-ai/nono) | +|---|---|---|---|---|---| +| Model | Local CLI exec broker | Local CLI exec broker (Go) | MCP `exec` tool in a secrets manager | HTTPS MITM proxy | Kernel sandbox + HTTP credential proxy | +| Brokers local CLIs (env-var creds) | ✅ | ✅ | ✅ | ❌ | ❌ (network only) | +| Brokers HTTP API calls | via the CLI | via the CLI, or MITM proxy mode | via the CLI | ✅ | ✅ | +| OS sandbox for the tool | ✅ Seatbelt / Landlock | ❌ (tool runs with daemon privileges) | ❌ | ❌ | ✅ Seatbelt / Landlock | +| Redacts tool stdout/stderr (incl. base64/hex/URL-encoded) | ✅ | user-supplied regex only | raw value only (docs: encoded forms leak) | ❌ | ❌ | +| Per-tool allowlist | ✅ | ✅ + blocked-arg patterns | ❌ (global secret allowlist) | egress filter | policy-as-code | +| Scoped / short-lived creds | mint locally (`gcloud`, etc.) | GitHub App tokens | ❌ | ❌ | ❌ | +| Runs offline, no account | ✅ single binary | ✅ | ✅ | ✅ | ✅ | +| License | Open source | MIT | MIT | Open source | Open source | + +[claw-wrap](https://github.com/dedene/claw-wrap) is the nearest relative — same daemon/socket/exec shape — but leaves sandboxing to an external tool and redacts only what you write regexes for. Airlock complements the proxy tools rather than replacing them: use a proxy for pure-API agents, Airlock for the tools the agent *runs*. + +Commercial identity gateways such as [Aembit](https://aembit.io/) and [1Password Unified Access](https://1password.com/blog/introducing-1password-unified-access) solve the same problem as a central, cloud-hosted service that vends short-lived credentials to workloads; hosted integration layers like [Arcade](https://www.arcade.dev/), [Composio](https://composio.dev/) and [Nango](https://nango.dev/) do it for SaaS APIs via OAuth. Neither brokers local CLI tools. Fuller notes in [COMPETITORS.md](COMPETITORS.md). + ## Quick start ```bash From 7466f8a939ec8d3ee75c5fcad22aa1c9035f6e7c Mon Sep 17 00:00:00 2001 From: Paavo Pokkinen Date: Wed, 26 Aug 2026 08:15:20 +0300 Subject: [PATCH 2/3] docs(readme): drop link to untracked COMPETITORS.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 94ceae1..5b36bb3 100644 --- a/README.md +++ b/README.md @@ -73,7 +73,7 @@ Most tools in this space are **HTTP proxies**: the agent sends a placeholder tok [claw-wrap](https://github.com/dedene/claw-wrap) is the nearest relative — same daemon/socket/exec shape — but leaves sandboxing to an external tool and redacts only what you write regexes for. Airlock complements the proxy tools rather than replacing them: use a proxy for pure-API agents, Airlock for the tools the agent *runs*. -Commercial identity gateways such as [Aembit](https://aembit.io/) and [1Password Unified Access](https://1password.com/blog/introducing-1password-unified-access) solve the same problem as a central, cloud-hosted service that vends short-lived credentials to workloads; hosted integration layers like [Arcade](https://www.arcade.dev/), [Composio](https://composio.dev/) and [Nango](https://nango.dev/) do it for SaaS APIs via OAuth. Neither brokers local CLI tools. Fuller notes in [COMPETITORS.md](COMPETITORS.md). +Commercial identity gateways such as [Aembit](https://aembit.io/) and [1Password Unified Access](https://1password.com/blog/introducing-1password-unified-access) solve the same problem as a central, cloud-hosted service that vends short-lived credentials to workloads; hosted integration layers like [Arcade](https://www.arcade.dev/), [Composio](https://composio.dev/) and [Nango](https://nango.dev/) do it for SaaS APIs via OAuth. Neither brokers local CLI tools. ## Quick start From f1704f2b43f86024534f30f5fe1b04143d54ec9b Mon Sep 17 00:00:00 2001 From: Paavo Pokkinen Date: Wed, 26 Aug 2026 08:19:56 +0300 Subject: [PATCH 3/3] docs(readme): simplify comparison table cells --- README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 5b36bb3..0f7139f 100644 --- a/README.md +++ b/README.md @@ -61,14 +61,14 @@ Most tools in this space are **HTTP proxies**: the agent sends a placeholder tok | | Airlock | [claw-wrap](https://github.com/dedene/claw-wrap) | [fnox MCP](https://fnox.jdx.dev/guide/mcp.html) | [Infisical Agent Vault](https://github.com/Infisical/agent-vault) | [nono](https://github.com/nolabs-ai/nono) | |---|---|---|---|---|---| -| Model | Local CLI exec broker | Local CLI exec broker (Go) | MCP `exec` tool in a secrets manager | HTTPS MITM proxy | Kernel sandbox + HTTP credential proxy | +| Model | Local CLI exec broker | Local CLI exec broker | MCP `exec` tool in a secrets manager | HTTPS MITM proxy | Kernel sandbox + HTTP credential proxy | | Brokers local CLIs (env-var creds) | ✅ | ✅ | ✅ | ❌ | ❌ (network only) | | Brokers HTTP API calls | via the CLI | via the CLI, or MITM proxy mode | via the CLI | ✅ | ✅ | | OS sandbox for the tool | ✅ Seatbelt / Landlock | ❌ (tool runs with daemon privileges) | ❌ | ❌ | ✅ Seatbelt / Landlock | | Redacts tool stdout/stderr (incl. base64/hex/URL-encoded) | ✅ | user-supplied regex only | raw value only (docs: encoded forms leak) | ❌ | ❌ | | Per-tool allowlist | ✅ | ✅ + blocked-arg patterns | ❌ (global secret allowlist) | egress filter | policy-as-code | -| Scoped / short-lived creds | mint locally (`gcloud`, etc.) | GitHub App tokens | ❌ | ❌ | ❌ | -| Runs offline, no account | ✅ single binary | ✅ | ✅ | ✅ | ✅ | +| Scoped / short-lived creds | ✅ | ✅ | ❌ | ❌ | ❌ | +| Runs offline, no account | ✅ | ✅ | ✅ | ✅ | ✅ | | License | Open source | MIT | MIT | Open source | Open source | [claw-wrap](https://github.com/dedene/claw-wrap) is the nearest relative — same daemon/socket/exec shape — but leaves sandboxing to an external tool and redacts only what you write regexes for. Airlock complements the proxy tools rather than replacing them: use a proxy for pure-API agents, Airlock for the tools the agent *runs*.