Cairde — an AI agent firewall.
Stop leaking sensitive data from your AI agents.
Deployed inside your own infrastructure, Cairde provides in-flight DLP, compliance audit trails, and
full spend attribution across all your AI coding agents.
AI agents can have access to everything
Developers rely on tools like Claude Code, Codex, and Cursor to ship faster, but as agents index
repositories, read local environments, and query customer records, sensitive data leaks to the
model
providers, where it can be used for their own auditing, training, or requested foreign disclosure.
Your data is at the mercy of their data breaches.
Credentials & IP Exposure
An agent debugging an issue reads .env files, production connection strings,
or proprietary algorithms. These are transmitted unredacted to third-party servers.
Audit Gap
Auditing terminal logs post-session does not prevent leaks; it just confirms them. There is no enforcement of security policies, as typically expected by SOC2, ISO 27001, or the EU AI Act.
Auditing Usage Costs
Agents loop through many tool and file-read calls per task. It is impossible to accurately determine costs across tasks and teams, especially when multiple model providers are in use.
Guardrails for LLM traffic
Placed directly between your agents and LLM providers, Cairde intercepts, redacts, and measures traffic to AI systems in real time. Using rules-based pattern matching, Cairde adds another layer of security to protect your data.
Inspection & Redaction
Real-time pattern matching can strip secrets, API keys, credentials, and other data (defined and controlled by you) before leaving your network.
Model Cache-Safety
Preserves provider prompt-cache headers and payload integrity, eliminating cache-miss latency penalties and preventing unintended billing spikes.
Universal Model Support
No agent plugins are necessary. Operates as a proxy across Anthropic, Google, OpenAI, and OpenRouter provided models.
Telemetry Integration
Ships real-time analytics events to OpenTelemetry-supported systems.
Cross-border compliance & the US CLOUD Act: Leading frontier model providers are US corporations subject to extraterritorial discovery under the CLOUD Act. Cairde redacts locally and keeps your audit trail on your own infrastructure, outside that reach.
Installation
Cairde is a single static binary and can be run locally or in a container.
Download & Install
Universal installer for Linux and FreeBSD. It will verify the binary checksum and optionally configure a background service.
# One-line install (Linux, FreeBSD)
curl -fsSL https://cairde.dev/install | sh
Route Your Agent1
Direct your coding agent's API requests to Cairde.
# Same machine as Cairde
source ~/.local/share/cairde/env.sh
claude
# Another machine — start Cairde with --bind <lan-ip> first
ANTHROPIC_BASE_URL=http://<cairde-host>:8787 claude
Observe & Analyse
Set up redaction rules. Inspect sessions, token usage, and live spend in real time.
# Embedded dashboard
http://localhost:8787/_cairde/
- OpenAI, Antigravity, and OpenRouter-compatible agents are supported; setup instructions will be available shortly.
- macOS builds available shortly.
Security and auditing combined
Cairde brings together security compliance, auditing, and financial planning for your AI usage.
Security
- Active enforcement: Intercept, mask, and redact proprietary source code, secrets, and PII before requests leave your environment.
- Compliance: Generate audit trails for SOC2, ISO 27001, and EU AI Act reviews.
- Policy-driven: Centrally define, test, and update data-loss-prevention rules without relying on developer compliance.
Technology
- Unblock velocity: Give developers full access to agentic tooling without compromising security.
- Zero disruption: Operates transparently at the network layer. No extensions or plugins to install.
- Model portability: Choose between Anthropic, Google, OpenAI, and open-weight models.
Finance
- Granular unit economics: Allocate AI expenditure by engineering team or task.
- Predictable budgeting: Supplement opaque month-end API invoices with real-time spend tracking.
- Real spend: Separate API spend from usage your subscriptions cover.
Get in touch
If you have any questions, feel free to reach out.