@agentreserve/proxy

Open-source egress proxy for AI agent governance. Intercepts outbound HTTP traffic from agents, enforces policy rules, and logs everything to a local SQLite audit database.

Features

• HTTP CONNECT proxy — works with any agent via HTTP_PROXY env var
• Policy enforcement — rate limits, time restrictions, domain blocking per URL pattern
• Audit logging — every request logged to SQLite with method, URL, status, duration, and policy decision
• Embedded dashboard — real-time stats, audit log viewer, and rule display at /_/dashboard
• YAML config — simple, declarative rule definitions
• Sensitive header redaction — Authorization, Cookie, X-API-Key auto-redacted in audit logs
• Zero external dependencies — no database server, no Redis, no cloud account needed

Quick Start

npx @agentreserve/proxy

Then point your agent at the proxy:

HTTP_PROXY=http://127.0.0.1:4100 your-agent-command

Open http://127.0.0.1:4100/_/dashboard to see the dashboard.

Configuration

Create an agentreserve.yaml in your working directory:

proxy:
  port: 4100
  host: "127.0.0.1"
  dashboard: true

rules:
  # Allow OpenAI with rate limiting
  - match: "api.openai.com/*"
    action: allow
    policies:
      - type: rate_limit
        max_requests_per_minute: 60

  # Allow Anthropic with rate limiting
  - match: "api.anthropic.com/*"
    action: allow
    policies:
      - type: rate_limit
        max_requests_per_minute: 30

  # Block internal APIs
  - match: "*.internal.company.com/*"
    action: deny
    reason: "Internal APIs are not accessible to agents"

  # Block sensitive AWS endpoints
  - match: "*.amazonaws.com/iam/*"
    action: deny
    reason: "IAM modifications blocked for agents"

  # Allow and log everything else
  - match: "*"
    action: log

audit:
  store: sqlite
  path: ./agentreserve-audit.db

Or specify a config path:

npx @agentreserve/proxy --config path/to/config.yaml

CLI Options

agentreserve-proxy [options]

  -c, --config <path>   Path to config file (default: ./agentreserve.yaml)
  -p, --port <number>   Override proxy port (default: 4100)
  --no-dashboard        Disable embedded dashboard
  -h, --help            Show help
  -v, --version         Show version

Rules

Rules are evaluated top-to-bottom. First match wins.

| Action | Behavior | |--------|----------| | allow | Forward request, evaluate attached policies, log to audit | | deny | Block request immediately, return 403, log to audit | | log | Forward request unconditionally, log to audit |

Policies

Policies are attached to rules and evaluated before forwarding:

| Policy | Config | Effect | |--------|--------|--------| | rate_limit | max_requests_per_minute | Returns 429 if exceeded (per domain) | | time_restriction | allowed_hours_start, allowed_hours_end, allowed_days | Blocks outside allowed window | | spending_limit | max_amount, currency | (Future) Track spending per domain |

Dashboard

The embedded dashboard is served at http://127.0.0.1:4100/_/dashboard and includes:

• Overview — total requests, allowed/denied counts, unique hosts, top hosts, recent denials
• Audit Log — searchable, filterable table of all intercepted requests
• Rules — display of active configuration rules and their policies

Auto-refreshes every 5 seconds.

Dashboard API

JSON endpoints are available for programmatic access:

GET /_/api/audit           # list audit logs (?limit, ?offset, ?hostname, ?decision, ?search)
GET /_/api/stats           # aggregated stats + top hosts + recent denials
GET /_/api/policies        # list policies from DB
POST /_/api/policies       # create a policy
DELETE /_/api/policies/:id # delete a policy
GET /_/api/config          # current proxy configuration

How It Works

Agent (Claude Code, Cursor, custom script)
    |
    | HTTP_PROXY=http://localhost:4100
    v
AgentReserve Proxy
    |
    ├── Match URL against rules (first match wins)
    ├── If "deny" → return 403, log to audit
    ├── If "allow"/"log" → evaluate policies
    │   ├── Rate limit check (per domain, sliding window)
    │   ├── Time restriction check
    │   └── If policy fails → return 429, log to audit
    ├── Forward request to target
    ├── Log request + response to SQLite audit
    |
    v
Target API (OpenAI, Stripe, Slack, etc.)

For HTTPS, the proxy uses HTTP CONNECT tunneling. The TLS connection is end-to-end between the agent and the target — the proxy sees the hostname but not the request/response body.

Development

# Install dependencies
cd packages/proxy
npm install

# Run in dev mode
npm run dev

# Run tests
npm test

# Type check
npm run typecheck

Testing

npm test

20 tests covering:

• Rule matching (exact, glob, wildcard, protocol stripping)
• Policy evaluation (rate limits, time restrictions)
• Config loading (YAML, JSON, defaults, merging)
• SQLite store (audit CRUD, stats, policies, filtering)

License

MIT