Metadata-Version: 2.4
Name: airiskguard
Version: 0.5.0
Summary: AIRiskGuard Gateway — AI traffic management. Route, protect and monitor every AI API call.
Author-email: AIRiskGuard <info@airiskguard.ai>
License: MIT
License-File: LICENSE
Keywords: ai,anthropic,cost,gateway,llm,openai,proxy,routing,security
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: MIT License
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Internet :: Proxy Servers
Classifier: Topic :: Security
Requires-Python: >=3.10
Requires-Dist: anyio>=4.0.0
Requires-Dist: click>=8.1.0
Requires-Dist: cryptography>=41.0.0
Requires-Dist: httpx>=0.25.0
Requires-Dist: mitmproxy>=10.3.1
Requires-Dist: pydantic-settings>=2.0.0
Requires-Dist: pydantic>=2.0.0
Requires-Dist: pyyaml>=6.0.0
Requires-Dist: rich>=13.0.0
Provides-Extra: dev
Requires-Dist: mypy>=1.0.0; extra == 'dev'
Requires-Dist: pytest-asyncio>=0.21.0; extra == 'dev'
Requires-Dist: pytest>=7.0.0; extra == 'dev'
Requires-Dist: ruff>=0.1.0; extra == 'dev'
Provides-Extra: server
Requires-Dist: aiosqlite>=0.19.0; extra == 'server'
Requires-Dist: alembic>=1.12.0; extra == 'server'
Requires-Dist: asyncpg>=0.29.0; extra == 'server'
Requires-Dist: fastapi>=0.100.0; extra == 'server'
Requires-Dist: jinja2>=3.1.0; extra == 'server'
Requires-Dist: passlib[bcrypt]>=1.7.4; extra == 'server'
Requires-Dist: python-jose[cryptography]>=3.3.0; extra == 'server'
Requires-Dist: python-multipart>=0.0.6; extra == 'server'
Requires-Dist: sqlalchemy[asyncio]>=2.0.0; extra == 'server'
Requires-Dist: uvicorn[standard]>=0.23.0; extra == 'server'
Description-Content-Type: text/markdown

# AIRiskGuard Gateway

![PyPI](https://img.shields.io/pypi/v/airiskguard-gateway)
![License: MIT](https://img.shields.io/badge/License-MIT-00d4ff.svg)
![Python 3.10+](https://img.shields.io/badge/python-3.10+-blue.svg)

AI traffic management for developer teams. A local HTTPS proxy that sits between your developers and AI provider APIs — routing, logging, and protecting every AI call.

**Free (MIT) · pip install · works with Claude Code, Cursor, Copilot, any AI tool**

## What it does

- **Smart routing** — route PII to an internal model, financial data to Azure, simple queries to cheaper models. Rules in plain YAML.
- **Cost dashboard** — see spend by model, by day, by team. Know your AI bill before it arrives.
- **Secrets + PII protection** — blocks API keys, SSNs, credit cards, and financial data before they reach external APIs.
- **Model allowlist** — define which models your team can use. Everything else is blocked at the proxy.
- **Session stickiness** — conversations stay on the same model. No broken contexts when routing changes.

## Quickstart

```bash
pip install airiskguard-gateway
airiskguard-gateway install-cert
airiskguard-gateway start
```

Then in your shell (add to `~/.zshrc` or `~/.bashrc`):

```bash
export HTTPS_PROXY=http://127.0.0.1:8080
export NODE_EXTRA_CA_CERTS=~/.config/airiskguard-gateway/mitmproxy-ca-cert.pem
```

That's it. Every AI call through Claude Code, Cursor, or any tool now passes through the gateway.

## Configuration

Config lives at `~/.config/airiskguard-gateway/config.yaml`. Generate the default:

```bash
airiskguard-gateway config init
```

Key settings:

```yaml
on_secrets_detected: block    # block | redact | log
on_pii_detected: redact       # block | redact | log

allowed_models:
  - claude-sonnet-4-6
  - gpt-4o
  - deepseek-chat
```

## Smart Routing

Route requests based on content, task type, language, or model:

```yaml
routing:
  sticky_sessions: true      # same conversation → same model
  session_ttl_hours: 24

  rules:
    # PII → never leaves the machine
    - match: contains_pii
      action: route_to
      destination: local_ollama

    # Simple questions → cheap model
    - match: task_type
      task_type: simple_qa
      action: route_to
      destination: deepseek_cheap

    # Chinese prompts → Chinese-optimized model
    - match: language
      language: zh
      action: route_to
      destination: moonshot

    # Downgrade all GPT-4 requests
    - match: model_pattern
      model_pattern: "gpt-4*"
      action: route_to
      destination: gpt_mini

  destinations:
    local_ollama:
      provider: ollama
      model: llama3.2

    deepseek_cheap:
      provider: deepseek
      model: deepseek-chat    # $0.14/M vs $10/M for GPT-4o

    moonshot:
      provider: moonshot
      model: moonshot-v1-8k

    gpt_mini:
      provider: openai
      model: gpt-4o-mini
```

## Supported Providers

Built-in — just set the env var:

| Provider | Env var | Notes |
|---|---|---|
| Anthropic | `ANTHROPIC_API_KEY` | |
| OpenAI | `OPENAI_API_KEY` | |
| DeepSeek | `DEEPSEEK_API_KEY` | 94% cheaper than GPT-4o |
| Moonshot | `MOONSHOT_API_KEY` | Chinese-optimized |
| GLM (Zhipu) | `GLM_API_KEY` | |
| MiniMax | `MINIMAX_API_KEY` | |
| Mistral | `MISTRAL_API_KEY` | |
| Azure OpenAI | `AZURE_OPENAI_API_KEY` | set `base_url` in config |
| Ollama | none | local models |

Add any OpenAI-compatible provider (vLLM, LiteLLM, etc.):

```yaml
providers:
  my_private_llm:
    base_url: https://llm.internal.company.com/v1
    format: openai
    api_key_env: MY_LLM_API_KEY
```

## CLI Commands

```bash
airiskguard-gateway start              # start proxy (foreground)
airiskguard-gateway start --daemon     # start as background daemon
airiskguard-gateway stop               # stop daemon
airiskguard-gateway status             # show status + last hour stats
airiskguard-gateway logs --tail 50     # view audit log
airiskguard-gateway logs --follow      # live log stream
airiskguard-gateway logs --blocked-only
airiskguard-gateway install-cert       # generate CA + install to OS trust store
airiskguard-gateway config init        # write default config.yaml
```

## Team Tier ($299/mo)

The free proxy runs locally. The Team tier adds:

- Web dashboard with cost breakdown by model
- Centralized policy server for all developer machines
- Slack alerts on blocked requests
- Per-team policies and model allowlists
- 30-day audit log retention

Start at [airiskguard.ai](https://airiskguard.ai/#pricing).

## License

Proxy core: **MIT** — free to use, modify, and distribute.
Policy server + dashboard (`src/airiskguard_gateway/policy_server/`): **Proprietary** — requires a Team license. See [airiskguard.ai/pricing](https://airiskguard.ai/#pricing).
