# Cairde

> Transparent, self-hosted AI agent firewall and control plane providing pre-flight DLP redaction, compliance audit logging, and spend attribution across AI coding agents.

## Overview

Cairde is an in-line network reverse proxy placed between developer workstations/CI runners and LLM providers (Anthropic, OpenAI, Google Gemini, OpenRouter). It intercepts, inspects, rewrites and measures agent traffic in real time.

Website: https://cairde.dev/

## Key Capabilities

- **In-Flight Data Loss Prevention (DLP):** Pattern and regex rules rewrite matching text in agent requests before they cross the network perimeter. Built-in rules cover cloud access keys, SCM and Slack tokens, JWTs and private key material; anything else is a rule you write. What is caught is determined by the rules you configure.
- **Cache-Safe Determinism:** Preserves provider prompt-caching headers and token alignment, avoiding latency penalties and cache-miss billing spikes.
- **Universal Agent Scope:** Works transparently at the network layer across coding agents, custom CLI agents, and CI pipelines.
- **Data Sovereignty & US CLOUD Act Insulation:** 100% self-hosted on your VPC, private cloud, or local daemon. Prompt payloads and telemetry never route through third-party multi-tenant SaaS gateways or foreign jurisdictions.
- **Telemetry & Compliance Audit Trails:** Real-time structured audit logs, and usage published as OpenTelemetry metrics over OTLP/HTTP, so any OTLP-capable collector can forward them to existing observability infrastructure — Prometheus-style exporters render them as `cairde_tokens_total` — for SOC2, ISO 27001, and EU AI Act compliance.
- **Spend Attribution & Guardrails:** Attribution of token consumption and cost per team, repository, project, or agent without opaque month-end aggregator bills.

## Comparison with Retrospective Log Scrapers

Unlike post-session file watchers that parse terminal logs after execution ends—when code and secrets have already reached external model servers—Cairde operates in-line on the wire, so a redaction rule takes effect before transmission rather than being recorded after it.

## Limitations

Cairde applies the rules you give it. It is a best-effort control, not a guarantee:

- Redaction is pattern-based. A secret no rule matches passes through unchanged.
- Coverage depends entirely on the rules you configure. The built-in set is small and high-confidence by design, not exhaustive.
- Cairde redacts what leaves. It does not scan or rewrite responses.
- It should be one layer among several, not the only thing standing between a credential and a provider.

These limits are stated in the software licence as well, which disclaims any warranty that particular data will be identified or redacted (`cairde license`).

## Links

- Main site: https://cairde.dev/
- Quickstart: https://cairde.dev/#install
- Evaluation & Contact: https://cairde.dev/#contact