Limitations and roadmap

What the AI Firewall does not do today, the known gaps in coverage and tooling, clients it cannot front, and the work that is planned but not built.

Not provided

Area	Detail
Cost controls	No rate limits, budgets, quotas, spend caps or cost tracking. Token counts are reported, not limited.
Response inspection	Guardrails read requests only. Model output is relayed unscreened.
Routing	No fallback between providers, no retries, no load balancing, no caching
Semantic guardrails	Rules are RE2 regex, integer caps and name globs. No classifier models.
Guardrail exceptions	No allowlist phrase that exempts text from a rule while the rest is still scanned
Cross-surface translation	A Messages client cannot reach a Chat-only provider through the gateway, or the reverse
Per-team policy	One policy per organisation. Vault bundles scope keys to principals, not rules.
Region pinning	See Jurisdictional control
Log retention control	Inference log rows are not deleted automatically, and there is no retention setting
Public admin API	Policy is written through the console, the CLI API (`/v2/cli.ai-firewall-*`) and the policy file. The gateway has no policy routes, and the console API takes session cookies only.

Tool calls cannot be undone. A coding agent runs a tool locally before its result reaches the gateway. A tool rule removes or refuses the tool on later requests.
Tool call arguments the model generates are in the response, so they are not scanned. Tool results the agent sends back are.
Client identity is self-reported. client_* rules read headers.
A pattern that does not compile is skipped while showing as enabled. The CLI’s status warns and apply refuses it; the console and API accept partial updates without a rule type.
Redaction breaks prompt caching when it rewrites text in a cached prefix.
Streamed Chat Completions without stream_options.include_usage log no tokens.
The CLI knows nine providers. key set and install do not cover alibaba, moonshot, minimax, kiro or custom providers; use the console or a policy file.
CLI token credentials. status, install, snippet, apply and export reject VULNETIX_API_TOKEN sign-ins with unsupported authentication method: token.
GET /v1/models responses carry no X-Vulnetix-Firewall-Request-Id.
Cursor. Some Cursor features (tab completion, Auto mode) never use a custom key or base URL, so they never reach the gateway. See Cursor.
Kiro refresh tokens. When AWS rotates a Kiro refresh token during use, each gateway replica keeps the new token in memory only; only the vault’s verify action saves it. GitHub and Google Kiro sign-ins cannot be used.

JetBrains Junie offers no base-URL override.
Clients not listed under Clients may work if they accept a custom OpenAI-compatible or Anthropic base URL, but have not been tested. See Other clients.

None of these exist today. Do not plan around them.