AIRiskGuard Gateway

AI traffic management for developer teams. A local proxy that sits between your developers and AI provider APIs — routing, logging, and protecting every AI call.

Free (MIT) · pip install airiskguard · works with Claude Code, Cursor, Copilot, any AI tool

What it does

• Smart routing — route PII to an internal model, financial data to Azure, simple queries to cheaper models. Rules in plain YAML. Session stickiness keeps conversations on the same model.
• Cost dashboard — see spend by model, by day, by team. Know your AI bill before it arrives.
• Sensitive data protection — blocks API keys, SSNs, credit cards, and financial data before they reach external APIs. Redacts or blocks based on your policy.
• Model allowlist — define which models your team can use. Everything else is blocked.
• Content classification — detects task type (code, summarization, translation, Q&A), complexity, and language to enable smarter routing rules.

Quickstart

pip install airiskguard
airiskguard-gateway start         # starts API proxy on localhost:8080

Configure your AI tool

Claude Code — set ANTHROPIC_BASE_URL:

export ANTHROPIC_BASE_URL=http://127.0.0.1:8080/anthropic

OpenAI Codex CLI — set OPENAI_BASE_URL:

export OPENAI_BASE_URL=http://127.0.0.1:8080/openai

DeepSeek / Moonshot / GLM / any provider:

export OPENAI_BASE_URL=http://127.0.0.1:8080/deepseek   # or /moonshot, /glm, /minimax

Cursor — use transparent proxy mode:

airiskguard-gateway start --mode proxy
# then: Settings → Features → HTTP Proxy → http://127.0.0.1:8080

Verify it's working

# In another terminal, after setting the env var above:
airiskguard-gateway logs --tail 5
# You should see your AI requests appear here

Two modes

airiskguard-gateway start              # API mode (default)
airiskguard-gateway start --mode proxy # Transparent proxy mode

Configuration

airiskguard-gateway config init   # write default config to ~/.config/airiskguard-gateway/config.yaml

Key settings:

on_secrets_detected: block    # block | redact | log
on_pii_detected: redact       # block | redact | log

allowed_models:
  - claude-sonnet-4-6
  - gpt-4o
  - gpt-4o-mini
  - deepseek-chat

Smart Routing

Rules are evaluated in order. First match wins. Session stickiness keeps a conversation on the same model once routed.

routing:
  sticky_sessions: true       # same conversation → same model
  session_ttl_hours: 24

  rules:
    # PII → local model, never leaves the machine
    - match: contains_pii
      action: route_to
      destination: local_ollama

    # Simple questions → 94% cheaper
    - match: task_type
      task_type: simple_qa
      action: route_to
      destination: deepseek_cheap

    # Chinese prompts → Chinese-optimized model
    - match: language
      language: zh
      action: route_to
      destination: moonshot

    # Downgrade all GPT-4 requests
    - match: model_pattern
      model_pattern: "gpt-4*"
      action: route_to
      destination: gpt_mini

    # Financial data → block external, or route to private endpoint
    - match: contains_financial_data
      action: block

  destinations:
    local_ollama:
      provider: ollama
      model: llama3.2

    deepseek_cheap:
      provider: deepseek
      model: deepseek-chat    # $0.14/M input vs $2.50/M for GPT-4o

    moonshot:
      provider: moonshot
      model: moonshot-v1-8k

    gpt_mini:
      provider: openai
      model: gpt-4o-mini

Available match types

Supported Providers

Built-in — just set the env var and route to the provider name:

Add any OpenAI-compatible provider (vLLM, LiteLLM, custom):

providers:
  my_private_llm:
    base_url: https://llm.internal.company.com/v1
    format: openai
    api_key_env: MY_LLM_API_KEY

CLI Reference

airiskguard-gateway setup              # first-time setup: cert + per-tool instructions
airiskguard-gateway start              # start in API mode (default)
airiskguard-gateway start --mode proxy # start in transparent proxy mode
airiskguard-gateway start --daemon     # start as background daemon
airiskguard-gateway stop               # stop daemon
airiskguard-gateway status             # show status + last hour stats
airiskguard-gateway logs --tail 50     # view audit log
airiskguard-gateway logs --follow      # live stream
airiskguard-gateway logs --blocked-only
airiskguard-gateway license YOUR-KEY   # validate a license key
airiskguard-gateway config init        # write default config.yaml
airiskguard-gateway config show        # print current config
airiskguard-gateway install-cert       # generate CA + install to trust store (proxy mode)

Team Tier ($299/mo)

The free proxy runs locally. The Team tier adds:

• Web dashboard with cost breakdown by model
• Centralized policy server — push policies to all developer machines
• Slack alerts on blocked requests
• Per-team model allowlists
• 30-day audit log retention

Start at airiskguard.ai.

Activating your license

# Validate your key
airiskguard-gateway license YOUR-LICENSE-KEY

# Start the policy server
AIRISKGUARD_LICENSE=YOUR-LICENSE-KEY docker compose up -d

License

Proxy core: MIT — free to use, modify, and distribute. Policy server + dashboard (src/airiskguard_gateway/policy_server/): Proprietary — requires a Team license.