AIRiskGuard Gateway

AI traffic management for developer teams. A local HTTPS proxy that sits between your developers and AI provider APIs — routing, logging, and protecting every AI call.

Free (MIT) · pip install · works with Claude Code, Cursor, Copilot, any AI tool

What it does

• Smart routing — route PII to an internal model, financial data to Azure, simple queries to cheaper models. Rules in plain YAML.
• Cost dashboard — see spend by model, by day, by team. Know your AI bill before it arrives.
• Secrets + PII protection — blocks API keys, SSNs, credit cards, and financial data before they reach external APIs.
• Model allowlist — define which models your team can use. Everything else is blocked at the proxy.
• Session stickiness — conversations stay on the same model. No broken contexts when routing changes.

Quickstart

pip install airiskguard-gateway
airiskguard-gateway install-cert
airiskguard-gateway start

Then in your shell (add to ~/.zshrc or ~/.bashrc):

export HTTPS_PROXY=http://127.0.0.1:8080
export NODE_EXTRA_CA_CERTS=~/.config/airiskguard-gateway/mitmproxy-ca-cert.pem

That's it. Every AI call through Claude Code, Cursor, or any tool now passes through the gateway.

Configuration

Config lives at ~/.config/airiskguard-gateway/config.yaml. Generate the default:

airiskguard-gateway config init

Key settings:

on_secrets_detected: block    # block | redact | log
on_pii_detected: redact       # block | redact | log

allowed_models:
  - claude-sonnet-4-6
  - gpt-4o
  - deepseek-chat

Smart Routing

Route requests based on content, task type, language, or model:

routing:
  sticky_sessions: true      # same conversation → same model
  session_ttl_hours: 24

  rules:
    # PII → never leaves the machine
    - match: contains_pii
      action: route_to
      destination: local_ollama

    # Simple questions → cheap model
    - match: task_type
      task_type: simple_qa
      action: route_to
      destination: deepseek_cheap

    # Chinese prompts → Chinese-optimized model
    - match: language
      language: zh
      action: route_to
      destination: moonshot

    # Downgrade all GPT-4 requests
    - match: model_pattern
      model_pattern: "gpt-4*"
      action: route_to
      destination: gpt_mini

  destinations:
    local_ollama:
      provider: ollama
      model: llama3.2

    deepseek_cheap:
      provider: deepseek
      model: deepseek-chat    # $0.14/M vs $10/M for GPT-4o

    moonshot:
      provider: moonshot
      model: moonshot-v1-8k

    gpt_mini:
      provider: openai
      model: gpt-4o-mini

Supported Providers

Built-in — just set the env var:

Add any OpenAI-compatible provider (vLLM, LiteLLM, etc.):

providers:
  my_private_llm:
    base_url: https://llm.internal.company.com/v1
    format: openai
    api_key_env: MY_LLM_API_KEY

CLI Commands

airiskguard-gateway start              # start proxy (foreground)
airiskguard-gateway start --daemon     # start as background daemon
airiskguard-gateway stop               # stop daemon
airiskguard-gateway status             # show status + last hour stats
airiskguard-gateway logs --tail 50     # view audit log
airiskguard-gateway logs --follow      # live log stream
airiskguard-gateway logs --blocked-only
airiskguard-gateway install-cert       # generate CA + install to OS trust store
airiskguard-gateway config init        # write default config.yaml

Team Tier ($299/mo)

The free proxy runs locally. The Team tier adds:

• Web dashboard with cost breakdown by model
• Centralized policy server for all developer machines
• Slack alerts on blocked requests
• Per-team policies and model allowlists
• 30-day audit log retention

Start at airiskguard.ai.

License

Proxy core: MIT — free to use, modify, and distribute. Policy server + dashboard (src/airiskguard_gateway/policy_server/): Proprietary — requires a Team license. See airiskguard.ai/pricing.