Continue

Continue runs inside VS Code and JetBrains IDEs and calls whatever model entries its config lists. It speaks the chat surface, so the entry can point at any chat provider you hold a key for. The CLI wires the openai provider.

With the CLI

vulnetix ai-firewall key set openai --from-env OPENAI_KEY   # once per organisation
vulnetix ai-firewall install continue --model gpt-4o-mini

It writes two files, both user scope:

File	Content
~/.continue/config.yaml	One entry in models, matched by its name. Comments and the other entries are kept. If only a legacy ~/.continue/config.json exists, the entry goes there, matched by title.
~/.continue/.env	VULNETIX_API_KEY=<your key>, mode 600

The entry it writes:

models:
  - name: Vulnetix AI Firewall (openai)
    provider: openai
    model: gpt-4o-mini
    apiBase: https://guardrails.vulnetix.com/openai/<uuid>/v1
    apiKey: ${{ secrets.VULNETIX_API_KEY }}
    roles:
      - chat
      - edit
      - apply

Without --model the entry uses gpt-4o. Reload the Continue extension, or restart the IDE, after installing.

By hand

Add the entry above to ~/.continue/config.yaml, then:

printf 'VULNETIX_API_KEY=%s\n' "$VULNETIX_API_KEY" > ~/.continue/.env
chmod 600 ~/.continue/.env

provider: openai names the wire protocol, not the vendor. To use another chat provider, change the slug in apiBase and use that provider’s own model name, for example apiBase: https://guardrails.vulnetix.com/openrouter/<uuid>/v1 with model: openai/gpt-4o-mini. Keep the name if you want install and uninstall to keep managing the entry.

Verify

vulnetix ai-firewall status should show continue as wired. points elsewhere means the entry’s apiBase is not the gateway, and raises bypasses_firewall. Then send a chat message from the IDE with the wired model selected.

Limits

• The written entry has the chat, edit and apply roles. A separate autocomplete or embeddings model in your config goes wherever its own entry points. The gateway has no embeddings route.
• Tool-call arguments are not scanned. Tool results are.
• A developer can change apiBase. status reports it.