Documentation

Getting Started

Get your first firewalled LLM call working, and understand the two keys, the base URLs, and the BYOK vault before you wire anything else.

Four commands take you from nothing to a firewalled coding agent. The pages below explain what each one did, and everything else you will need.

vulnetix auth login
vulnetix ai-firewall key set anthropic --from-env ANTHROPIC_KEY
vulnetix ai-firewall install claude-code
vulnetix ai-firewall status
Overview
What the gateway does to a request, in order.
Quickstart
From zero to a firewalled call, with the CLI or by hand.
Your two keys
The Vulnetix API key vs. the provider key. Confusing them is the #1 support ticket.
BYOK: the provider key vault
KMS-encrypted, org-bound, write-only. How to store, rotate, and remove a key.
Base URLs & request surfaces
Three surfaces, two base-URL shapes. Read this before you configure anything by hand.
Install the CLI
Homebrew, Scoop, Nix, Go, curl — then log in.
Verify
Prove traffic is actually going through the firewall.
Overview
What the AI Firewall does to a request, in the order it does it — and what it never does.
Quickstart
From nothing to a firewalled LLM call — with the CLI, or by hand if you prefer to see every moving part.
Your two keys
The Vulnetix API key authenticates you to the firewall. The provider key is what the firewall sends upstream. Confusing them is the most common failure.
BYOK: the provider key vault
Store each provider key once, KMS-encrypted and bound to your organisation. Your applications never carry it, and nothing can read it back — including you.
Base URLs & request surfaces
Three request surfaces, two base-URL shapes. The OpenAI and Anthropic SDKs disagree about /v1, and that disagreement is the most common misconfiguration.
Install the CLI
The Vulnetix CLI is how you manage firewall policy and wire your machine. Install it, log in, and you are ready.
Verify
Prove your traffic is actually going through the firewall — and find the traffic that is quietly bypassing it.