Packages checked before they land
npm i zod@3.23.8✓ clean
npm i lodahs✕ malware
pip install reqeusts✕ typosquat
npm i lodash@4.17.15✕ high CVE
Armor1 Boundary · Private beta
CISO-approved coding agents
Boundary keeps your coding agent’s credentials out of reach, checks the code it pulls in and pushes out for security issues, and sends tasks to the most cost-efficient model.
macOS on Apple silicon · Works alongside Armor1
Boundary
$armor1-boundary
laneweb-team · OpenCode · sandbox ready
allowmodelanthropic/claude-sonnet-4-6
allownpmzod@3.23.8 · osv clean
allowgit pushfix/login-redirect
denygit pushmain · protected-main
denyread~/.aws/credentials · not mounted
denynpmlodahs@0.0.1-security · package-malware
denycurlpaste site · not in lane
exit3 files changed · Apply these changes? [y/N]
Example session. The reason codes are the ones Boundary records.
Secure by defaultYour keys never enter the sandbox, and every request is checked against your team's lane.Safe code, built inPackages are checked before they install, secrets are caught before a push leaves, and an AI reviewer checks every session's changes.Spend under controlSee the cost of every model call, use the keys you already have, and route each task to the most cost-efficient model.Proof from prompt to prodBuilt-in compliance: every action and block recorded, every commit tied to its session, every admin change audited.
Why containment
Guardrails catch risky actions. Containment removes them.
Inside the sandbox
$ gcloud auth print-access-token
ya29.a0AfB_byC…
Next model request
POST /v1/messages
"…token: ya29.a0AfB_byC…"
Leaves your MacModel provider
1,156
times agents minted a cloud token and carried it into their context, seen by Armor1 across 247 developers in 90 days
22 of 24
runs where a public sandbox policy still let the real token reach the model provider
26 of 26
runs where the token never entered the Boundary sandbox, and the agent still finished the job
Armor1 shows you what your agents do. Boundary takes away what they shouldn't be able to do.
How it works
One way out, and the broker holds the keys.
Step 1 · Start
Run it in your project
$ armor1-boundary
✓ sandbox ready · repo copy only
Step 2 · Work
Work the way you already do
$ git push origin fix/login
✓ allowed · through the broker
Step 3 · Review
Decide what lands
3 files changed
Apply these changes? [y/N]
Inside the line
Inside the line: your agent. Outside it: your keys.
Let it push, install and test. Just not anywhere it shouldn't.
The agent can
- Edit, run tests and install packages
- Commit, push feature branches and open PRs
- Read PRs, issues, checks and CI logs
- Use the models and MCP servers your lane allows
The agent can't
- See your keys, SSH folder or cloud credentials
- Push to
main, delete branches or merge - Reach a paste site or call a provider directly
- Install known malware or typosquats
Afterward you get
- A diff you approve before anything lands
- A record of every allow and deny
- The model cost of every call
- Commits that name their session
For teams: lanes per person or email domain, rules that know what already happened in a session, and a learning mode that tightens a lane from what the agent actually used.
Safe code, built in
AppSec at every step the agent takes. Nothing to install, nothing to wire into CI.
Boundary checks the code your agent pulls in, the commits it pushes and the changes it makes, using the same session, with no scanners for developers to set up.
Secrets never leave in a commit
$ git push origin fix/login
! [remote rejected] secret-in-push
config/deploy.ts:12 · aws-access-token
secret value never shown
An AI reviewer reads every change
Armor1 Boundary · AI review1 high findingsrc/api/users.ts:48 · SQL injection
ran in the background
Spend under control
Pay for the model the task needs, not the most expensive one.
Every model call goes through Boundary, so every call is priced, and your team decides which models a job may use.
Every call priced
gemini-flash1.2k tok$0.002
claude-sonnet8.4k tok$0.041
gpt · failed2.1k tok$0.009
Session$0.052
Keys and plans you already have
GeminiClaudeOpenAIChatGPT plan
0% markupAutomatic model routing
Fix a typo
- Small$
- Mid$$
- Large$$$
Proof
Same agent, same prompt, three setups.
We rebuilt three of the most common credential findings Armor1 sees in production and counted the model calls that carried the real credential.
Agent mints a cloud token
Claude Code in Docker
5 of 6 calls (83%)
OpenShell, public policy
3 of 6 calls (50%)
Armor1 Boundary
0 of 6 calls
Agent reads a token from an MCP config
Claude Code in Docker
5 of 12 calls (42%)
OpenShell, public policy
4 of 10 calls (40%)
Armor1 Boundary
0 of 11 calls
Agent prints a config file while debugging
Claude Code in Docker
5 of 10 calls (50%)
OpenShell, public policy
6 of 10 calls (60%)
Armor1 Boundary
0 of 13 calls
One recorded run per scenario, October 1–2, 2026. In every setup the agent completed the task.
Questions
Before you ask
My agent already has a sandbox.
Built-in sandboxes are configured by the agent and run next to your keys. Boundary keeps the keys outside entirely and checks every request against your team's rules.
Why not just run it in Docker?
A container keeps the agent off your filesystem, but the keys you pass in go with it and the network is open. Boundary's only way out is a broker that holds the keys.
How does it relate to Armor1?
Armor1 protects the AI tools your developers already run, with nothing to install. Boundary is an opt-in for the work you want contained.
The beta
What you need
- ComputerMac with Apple silicon
- AgentOpenCode, set up for you
- ModelsYour Gemini, Claude or OpenAI key, or a ChatGPT subscription
- Source hostGitHub
Let it work. Don't let it wander.
Boundary runs OpenCode on Apple-silicon Macs today. More agents are coming; we'll say when. Beta seats open in small groups.
Already using Armor1? Boundary works alongside it. Armor1 keeps protecting the AI tools your developers run today, with nothing to install; Boundary is an opt-in for the work you want contained.