Generating code

vulnetix ai-firewall snippet --lang python --sdk openai

Prints a runnable client, already carrying your organisation UUID, the right base URL for that provider’s surface, and a model your policy permits. Copy it into your project and it works.

It exists because the two things people get wrong are the two things a generator cannot get wrong: the base URL shape and the model name.

What you can generate

The complete matrix. These are the combinations that exist:

--lang--sdk
pythonopenai, anthropic, langchain, llamaindex
tsopenai, anthropic, vercel-ai
goopenai
shcurl
vulnetix ai-firewall snippet --lang ts --sdk vercel-ai
vulnetix ai-firewall snippet --lang python --sdk anthropic --provider anthropic
vulnetix ai-firewall snippet --lang sh --sdk curl > try-it.sh

Anything else is hand-written — see the SDK tutorials, which cover a further dozen languages.

Options

FlagDefault
--providerThe first provider with a stored key
--modelA model your policy allows
--output-filestdout

Why this is not a convenience

Note

Most providers have no base-URL environment variable that any SDK reads.

There is no MISTRAL_BASE_URL, no GROQ_BASE_URL, no TOGETHER_BASE_URL that the official SDKs honour. And the Vercel AI SDK ignores OPENAI_BASE_URL entirely.

For those, setting base_url in code is not a nicety you could skip — it is the only mechanism there is. That is why a code generator, rather than a set of environment variables, is the primary path for SDK users.

Coding agents are the exception: they read config files, which is why install can wire them without you touching code.

It gets the base URL right

Which is the whole point, because the two surfaces disagree:

# --sdk openai → the /v1 form
base_url = "https://guardrails.vulnetix.com/openai/<org>/v1"

# --sdk anthropic → no /v1, because the Anthropic SDK appends it
base_url = "https://guardrails.vulnetix.com/anthropic/<org>"

Getting this wrong produces a 404 unsupported_api. See base URLs.

It gets the model right

--model defaults to a model your organisation’s policy actually allows. If you are in allowlist mode, the generated snippet uses something on the allowlist — not a model that would 403 the moment you ran it.