The questions that come up first
If something here is not covered, the documentation goes considerably deeper, and every feature links to its own guide.
What is it, in 1 sentence?
A proxy you run yourself that sits between your applications and your AI services (LLM APIs, MCP servers, and A2A agents) and gives you inspection, policy enforcement, and an audit trail over everything that crosses.
Do I actually need this?
If you have 1 application talking to 1 provider, probably not. A budget alert on the provider console will cover you.
It starts earning its place when you have more than 1 team, more than 1 provider, MCP servers with tools that can act, or an obligation to explain to somebody what your AI systems did and who asked them to.
How much latency does it add?
The checks run concurrently rather than in sequence, so the added latency tracks the slowest single check rather than the sum of all of them. Local checks such as policy matching and redaction are compiled regex over the body. If you enable a third-party guardrail provider, that network call is normally the slowest thing in the path.
You can also run in monitor-only mode, where nothing blocks and you are only paying for observation.
Will it work with my provider?
LLM proxying is provider-shaped rather than provider-specific, and normalization exists for the major API formats including OpenAI-compatible, Anthropic, Gemini, and Cohere. MCP proxying speaks both the 2026-07-28 spec and the legacy 2024-11-05 spec over HTTP, WebSocket, and SSE, with a compatibility bridge so a modern client can still reach a legacy server.
If you point it at something unusual, monitor-only mode is a safe way to find out before you enforce anything.
Does anything leave my network?
Only the requests you were already sending to your own AI providers. There is no telemetry, no licence check, and no call home.
The exception is deliberate: if you enable a third-party guardrail provider, content is sent to that provider because that is what you asked it to do. Leave those disabled and nothing goes anywhere new.
Is it production ready?
v2026.8.1 is the first full release, after a beta series and a whole-platform security review. It is used in real deployments.
It is also maintained by 1 person and shipped as-is, so the honest answer is: test it against your own traffic, start in monitor-only, and satisfy yourself before you put it in a path you cannot afford to lose. That is good advice for any inline component.
What happens when something goes wrong at 3am?
Design for it: per-proxy circuit breakers stop a failing provider cascading, guardrail providers can be set to fail-open, and the liveness probe does not fail on a database outage, so an orchestrator will not restart-storm you.
There is no support phone number. There is documentation, a troubleshooting guide, and an issue tracker.
How do I upgrade?
Replace the binary and restart. Schema migrations are tracked in a ledger so they run once, and configuration carries forward. Read the changelog first, because occasionally a release adds a required setting.
Because there is no licence check and no expiry, staying on an older version is always a valid choice.
Can I turn features off?
Every control is opt-in. A fresh proxy behaves like a plain reverse proxy until you assign a policy, set a budget, or enable redaction. Upgrades do not switch new controls on for existing proxies.
What is the catch?
It is free, it does not meter you, and it does not phone home, so the catch is not commercial. The catch is that support is 1 person's spare attention, and that you are the 1 running the infrastructure.
Easiest way to answer the rest
Download it, start it in monitor-only, and point 1 proxy at something you already run.