Matchlock is a CLI tool that runs AI agents in ephemeral microVMs, providing a secure environment with network allowlisting and secret injection via a MITM proxy. It ensures that secrets never enter the VM and offers a full Linux environment that boots in under a second, isolating and locking down the agent by default.