AI Firewall overview

The AI Firewall is a gateway at https://guardrails.vulnetix.com. You point an LLM client’s base URL at it instead of at the provider and give it your Vulnetix API key instead of the provider key. The gateway checks the request against your organisation’s policy, swaps in the provider key it holds for you, and forwards the request. Streaming responses are relayed as server-sent events.

https://guardrails.vulnetix.com/{provider}/{orgUuid}/v1      OpenAI-shaped SDKs
https://guardrails.vulnetix.com/anthropic/{orgUuid}          Anthropic SDKs (no /v1)

The whole configuration is a base URL and an API key, so any client that lets you change those two settings can be firewalled. No custom headers are needed.

What happens to a request

Each step can end the request with its own status and code. All codes are on Error reference.

1. Provider. The first path segment names the provider. Unknown is 404 unknown_provider; disabled in the catalog is 403 provider_disabled.
2. Surface. The provider must serve the route you called (chat/completions, responses or messages). If not, 404 unsupported_api with the route to use instead. This runs before authentication so a wrong base URL says so.
3. Authentication. The org UUID in the path and the Vulnetix API key in Authorization: Bearer or x-api-key. Failure is 401 invalid_api_key. A backend outage is 503; authentication never fails open.
4. Provider policy. 403 provider_denied when the org denies the provider, 403 provider_key_missing when no key is stored for it.
5. Body. Up to 8 MiB (413 request_too_large), valid JSON, with a model.
6. Model policy. 403 model_denied for a denied model; 403 model_not_allowed when the provider is in allowlist mode and the model is not listed.
7. Inventory. The tools, MCP servers and skills the request carries are recorded, whether or not the request is then allowed.
8. Sealed blocks. Harness blocks sealed with gateway nonces are verified.
9. Guardrails. Capability rules, then content rules in priority order. A block match is 403 request_blocked; redact rewrites the request; strip removes a tool or MCP server; flag records and allows. A rule can also hold the request for review.
10. Upstream. The provider key is decrypted, your Vulnetix credential is removed, and the request is forwarded. Every response carries X-Vulnetix-Firewall-* headers saying what the firewall did.

What it does not do

• No rate limits, spend caps or budgets.
• No markup and no resale: requests go out on your own provider key, and your billing relationship with each provider is unchanged.
• No response inspection: only requests are screened.
• It cannot undo a tool call that already ran on a developer’s machine; a tool rule removes or refuses the tool on later requests.
• It governs only traffic sent to it. A developer who unsets the base URL variable talks to the provider directly again, which is what vulnetix ai-firewall status reports as bypasses_firewall (Status and checks).

The full list is on Limitations and roadmap, and a comparison with other gateways is on Alternatives.

Plans

The gateway and the key vault are on every plan. Policy is what paid plans add. The API checks the plan when a rule is written, and the gateway checks it again on every request, so a rule stops being enforced after a downgrade.

Feature	Minimum plan
Gateway, provider keys (BYOK), inventory	Community
Provider allow/deny, model allow/deny	Pro
Inference logging (metadata only)	Pro
Guardrails: content rules and capability rules	Teams

In the console

The console page is Resolve > AI Firewall. Its tabs, with their URL hashes:

Group	Tab	Hash	Covers
Set up	Overview	#overview	Policy state, gateway endpoint, activity
Set up	Connect	#connect	Providers, keys, custom providers
Policy	Govern	#govern	Provider and model allow/deny
Policy	Guardrails	#guardrails	Content rules and the baseline
Agent capability	MCP	#mcp	MCP server rules and inventory
Agent capability	Tools	#tools	Tool rules and inventory
Agent capability	Clients	#clients	Client rules and inventory
Agent capability	Skills	#skills	Skill rules and inventory

Older links keep working: #usage and #byok open Connect, #providers and #models open Govern, #context and #agents open MCP.

Find the page for your task

I want to	Read
Route my first request through the gateway	Quickstart
Understand the two keys and the two URL shapes	Keys and base URLs
Set up Claude Code, Codex, Cursor or another agent	Clients
Wire every client on my machine at once	Wiring clients
Allow only some models	Models
Block secrets in prompts	Block secrets
Stop an agent being offered a tool	Tools
Keep the policy in git	Policy as code
Find out why a request was refused	Error reference
See what the gateway records	Data handling

Platform IaC

The AI Firewall’s config-as-code document is .vulnetix/ai-firewall.yaml with apiVersion: vulnetix.com/v1 and kind: AiFirewallPolicy. vulnetix ai-firewall export writes it from the live policy and vulnetix ai-firewall apply reconciles the live policy to it (since CLI v4.0.0 both are aliases of the config engine, so vulnetix config plan shows the same result); every field is on Policy file reference. A file is a Platform IaC document by its content, so vulnetix config validate checks this one too, and .vulnetix/ai-firewall.yaml is one of three well-known files it reads. The same document also works under .vulnetix/config; define it in one place. See Which files are Platform IaC documents.

The kinds are AiFirewallPolicy, AiProvider and AiGovernanceList: the policy, the tenant’s custom providers, and its tool, MCP server, skill and client allow and deny lists. The config engine applies all three, and each has a Terraform resource (Terraform and OpenTofu). A guardrail can take a when, a CEL expression over the request’s provider, model, client, tools, MCP servers and skills; see CEL rule expressions.