🐾 Observe every model exchange. Hold only what policy must decide.

---

✨ What this app is

local-proxy is OpenLeash's cross-platform reverse proxy and enforcement relay for local AI agents. It understands Anthropic Messages, OpenAI Chat Completions, and OpenAI Responses traffic, reconstructs prompts and tool calls, sends normalized events to client-api, and applies policy decisions before protected traffic continues.

Claude Code / Codex / Cursor / OpenCode / other agents
                         │
                         ▼
                   local-proxy
                  raw → parsed
                         │
                         ▼
              client-api plugin pipeline
                         │
                   allow / replace / deny
                         │
                         ▼
                 model provider API

The proxy complements provider-specific API hooks. The proxy is authoritative for model traffic it can observe; hooks remain useful for agent lifecycle events and last-mile enforcement surfaces that do not traverse a model API.

---

🔥 What it handles

• Anthropic Messages, OpenAI Chat Completions, and OpenAI Responses requests
• JSON and SSE response reconstruction, including split and multi-line events
• User prompts, assistant responses, tool calls, and tool results
• Claude session metadata and agent attribution headers
• Prompt replacement returned by policy plugins before provider forwarding
• Synchronous tool-call gating before any gated response bytes are released
• Asynchronous text-response telemetry when no pre-execution decision is required
• HTTP streaming, redirects, WebSockets, corporate proxy chaining, and hop-by-hop header sanitation
• Bounded bodies, concurrency limits, timeouts, and TCP backpressure

---

🛡 Enforcement model

Protected request and tool-call evaluations suspend only their asynchronous request task; they do not occupy a CPU thread while waiting. Unrelated traffic continues normally.

The proxy fails closed by default. If client-api is unavailable or evaluation times out, protected traffic is denied. Operators can explicitly opt into fail-open behavior with OPENLEASH_PROXY_FAIL_OPEN=true when their risk model requires availability over enforcement.

Default limits include 16 MiB intercepted requests, eight simultaneous request evaluations, 8 MiB gated responses, and eight simultaneous response gates. These limits are configurable and apply backpressure instead of allowing unbounded memory growth.

---

🛠 Run locally

Requirements: a stable Rust toolchain and a running OpenLeash client-api.

cargo run

Configure the agent's provider base URL to point at the proxy and set:

export OPENLEASH_PROXY_UPSTREAM="https://api.anthropic.com"
export OPENLEASH_CLIENT_API="http://127.0.0.1:9318"
export OPENLEASH_TOKEN="your-client-api-token"
cargo run --release

For an OpenAI-compatible agent, use its OpenAI upstream instead. The desktop client normally installs and configures this automatically for monitored agents.

---

⚙️ Configuration

Variable	Purpose
OPENLEASH_PROXY_UPSTREAM	Provider API origin receiving allowed traffic.
OPENLEASH_CLIENT_API	OpenLeash evaluation API URL.
OPENLEASH_TOKEN	Authentication token for client-api.
OPENLEASH_CORPORATE_PROXY	Optional existing organization proxy to chain through.
OPENLEASH_PROXY_FAIL_OPEN	Explicitly allow protected traffic when evaluation fails. Defaults to false.
OPENLEASH_PROXY_MAX_BODY_BYTES	Maximum intercepted request size.
OPENLEASH_PROXY_MAX_CONCURRENT_REQUEST_EVALUATIONS	Concurrent protected request evaluations.
OPENLEASH_PROXY_MAX_GATED_RESPONSE_BYTES	Maximum held response size per gate.
OPENLEASH_PROXY_MAX_CONCURRENT_GATES	Concurrent gated provider responses.
OPENLEASH_PROXY_EVALUATION_TIMEOUT_SECONDS	Maximum synchronous evaluation wait.

---

✅ Verify

cargo fmt --check
cargo clippy --all-targets -- -D warnings
cargo test

The test suite covers provider URL construction, header filtering, Anthropic and OpenAI prompt rewrites, tool-call normalization, Claude metadata, and fragmented SSE parsing.

---

🔐 Security

Please report vulnerabilities according to SECURITY.md. Never include live provider keys, OpenLeash tokens, or captured prompt contents in a public issue.

Fast in the common path. Firm at the decision boundary.