Windsurf

Windsurf's custom OpenAI-compatible provider can point at the gateway. Its built-in models do not use it.

Windsurf keeps the setting in application state, so the CLI never writes it. install windsurf prints what to paste (abridged):

vulnetix ai-firewall install windsurf

Windsurf: Settings > Cascade > Model Provider (custom OpenAI endpoint)
    Base URL: https://guardrails.vulnetix.com/openai/<uuid>/v1
    API key:  your $VULNETIX_API_KEY

Set it up

Store the provider key once: vulnetix ai-firewall key set openai --from-env OPENAI_KEY.
In the model provider settings, add a custom OpenAI-compatible endpoint with the base URL above (with /v1) and your Vulnetix API key.
Add the model ids you will use. Windsurf does not read them from the gateway.
Select one of those models explicitly.

The CLI prints the menu path it knows; Windsurf can move it between releases.

Verify

status reports Windsurf as manual and cannot read the setting. Send a chat message that a guardrail blocks with your model selected; a 403 naming the rule is the proof.

Limits

Built-in models and completions bypass the gateway.
Tool-call arguments are not scanned.
For an editor agent whose traffic all goes through the gateway, use Continue.