{{ currentTabName }}
Welcome to Gatewell
Your firewall is live. Complete these steps to start inspecting AI traffic — each links to the right place.
{{ gateHeadline }}
Request throughput
All providers operating within posted bounds. {{ stats.activeRules }} rules enforcing, {{ agents.filter(a => isAgentOnline(a)).length }} agents armed, {{ alerts.filter(a => a.blocked).length }} hostile prompts intercepted in the last 24h.
Alert activity
Top rules
No rule hits recorded yet
Provider mix
Threat heatmap
Recent Security Events
| Time | Rule | Status | Details |
|---|---|---|---|
| {{ formatDate(alert.created_at) }} | {{ alert.rule_name }} | BLOCKED FLAGGED | {{ maskPreview(alert.snippet, 80) }} {{ maskCount(alert.snippet) }} masked |
|
No alerts — all clear |
|||
BLOCKED FLAGGED {{ selectedIncident.rule_name }}
Triggered on {{ selectedIncident.direction }} at {{ formatDate(selectedIncident.created_at) }}
User ID
{{ selectedIncident.user_id || '—' }}
Source IP
{{ selectedIncident.ip || '—' }}
Direction
{{ selectedIncident.direction }}
Alert ID
#{{ selectedIncident.id }}
Device Agent
{{ selectedIncident.agent_id }}
Device User
{{ selectedIncident.device_user }}
AI Risk Score
{{ selectedIncident.llm_score_explanation }}
Rule Details
{{ selectedIncident.rule.description }}
{{ selectedIncident.rule.pattern }}Triggered Content (Request)
AI Response
Original Request
Prompt captured at {{ formatDate(selectedIncident.matched_prompt.created_at) }} · Provider: {{ providerLabel(selectedIncident.matched_prompt.provider) }}
Original Request
No matching request found for this alert.
Recent Prompts from This User
{{ selectedIncident.user_prompts.length }}No user ID associated with this alert — related data unavailable.
Add New Rule
- Tool round-trip {{ formatDate(p.created_at) }} → {{ maskPreview(p.response_snippet, 120) }}
-
{{ idx + 1 }} {{ formatDate(p.created_at) }} score {{ (p.llm_score * 100).toFixed(0) }}
Prompt #{{ selectedPrompt.id }}
Captured at {{ formatDate(selectedPrompt.created_at) }}
User ID
{{ selectedPrompt.user_id || '—' }}
Source IP
{{ selectedPrompt.ip || '—' }}
Agent
{{ selectedPrompt.agent_id }}
Device User
{{ selectedPrompt.device_user }}
Provider
{{ selectedPrompt.provider }}
Prompt ID
#{{ selectedPrompt.id }}
AI Risk Score
{{ selectedPrompt.llm_score_explanation }}
User Prompt
AI Response
Raw Request
Detection Marketplace
One-click DLP rule packsVendor-curated bundles of detection rules. Installing a pack adds its rules to your Rules Engine; uninstalling removes exactly those rules.
{{ pack.name }}
{{ pack.category }} Installed{{ pack.description }}
Test Your Rules
Connect to the Firewall
Route any AI tool through the firewall for DLP inspection, audit logging, and policy enforcement. Supports Anthropic and OpenAI-compatible formats.
:8080 → /v1/messages
OPENAI :8080 → /v1/chat/completions
MANAGEMENT :80
Set one environment variable before launching Claude Code.
# Set once in your shell profile export ANTHROPIC_BASE_URL="http://<firewall-host>:8080" claude
{{ pythonSnippet }}
{{ nodejsSnippet }}
{{ agentSnippet }}
{{ cursorSnippet }}
{{ aiderSnippet }}
{{ continueDevSnippet }}
{{ openaiPythonSnippet }}
{{ openaiNodeSnippet }}
{{ openaiCurlSnippet }}
{{ dockerSnippet }}
| Variable | Default | Description |
|---|---|---|
| UPSTREAM_URL | https://api.anthropic.com | Anthropic upstream endpoint |
| OPENAI_UPSTREAM_URL | https://api.openai.com | OpenAI-compatible upstream endpoint |
| MANAGEMENT_URL | http://management:9000 | Management server URL |
| REDIS_URL | - | Redis for caching + rate limiting |
| RATE_LIMIT_RPM | 60 | Per-IP requests per minute |
| CACHE_TTL | 3600 | Response cache TTL (seconds) |
Supported Providers
Any tool that lets you set a custom base URL can route through the firewall. The same DLP rules apply across all providers.
Anthropic
/v1/messages
OpenAI
/v1/chat/completions
Groq
OpenAI-compatible
Together
OpenAI-compatible
Mistral
OpenAI-compatible
DeepSeek
OpenAI-compatible
Ollama
OpenAI-compatible
vLLM
OpenAI-compatible
Monitors AI web apps (ChatGPT, Claude.ai, Gemini, Perplexity) and enforces DLP rules before prompts are sent.
chrome://extensions and enable Developer ModeRequires an extension type agent created in the Agents tab.
Runs a local proxy on localhost:8100 that routes AI traffic through the cloud firewall. Auto-configures shell env vars for Anthropic and OpenAI tools.
# Install and run ./gatewell-device-agent --install --daemon # Or run manually ./gatewell-device-agent --daemon
Requires a device type agent created in the Agents tab. Download binaries from the GitHub Releases page.
A single self-contained binary that replaces the legacy Python agent scripts. It monitors and (optionally) proxies desktop AI tools, and pairs with the management console using a short device code — the /pair page approves it.
gatewell setup — it prints a device code# After downloading — pair with this console
gatewell setup
Assets are published per-OS on each GitHub Release. If a direct link 404s, grab the matching asset from releases/latest.
Add Webhook
Configured Webhooks
{{ webhooks.length }} totalNo alert ever leaves this box
With no webhooks configured, every alert the firewall raises is written to the database and stops there — nothing is pushed to Slack, a SIEM, or on-call. You will only see incidents if someone opens this console.
{{ hook.url }}
Payload Format
// Headers X-Webhook-Event: alert X-Webhook-Signature: sha256=<hmac-sha256-hex> X-Webhook-ID: <webhook-id> // Body { "rule_id": 3, "rule_name": "Block: Secrets", "user_id": "alice", "blocked": true, "timestamp": "2026-03-12T10:00:00Z" }
Create API Key
sk-fw-* · used by clientsCreating your first key enables enforced mode
The firewall currently runs in open mode — all requests are allowed. Generating a key switches it to enforced mode: every client (including ones already connected) must send a valid sk-fw-* key in X-API-Key or Authorization: Bearer, or it gets rejected. Update your client config with the key below right after generating it.
Encrypted at rest. Clients sending any other upstream key will get 401 (BYO disabled).
How it works:
When API keys exist, all requests to the firewall must include a valid X-API-Key header (sk-fw-*).
If no keys are created, the firewall runs in open mode (no key required).
Managed credentials: When you attach an Upstream Provider + credential to a key, the firewall injects that credential server-side and rejects any other API key the client sends (BYO disabled). Leave it blank for legacy pass-through behaviour.
Active Keys
{{ apiKeys.filter(k => !k.revoked).length }} active / {{ apiKeys.length }} totalThe firewall is in open mode — anyone who can reach it is allowed through
With zero keys, no X-API-Key header is required and
every client is accepted unauthenticated. Issuing the first key flips the firewall
into enforced mode, so update your clients right after you generate it.
| Name | Key Prefix | Status | Upstream | Rate Limit | Last Used | Actions |
|---|---|---|---|---|---|---|
| {{ key.name }} | {{ key.key_prefix }} | {{ key.revoked ? 'Revoked' : 'Active' }} | {{ key.upstream_provider }} pass-through | {{ key.rate_limit_rpm ? key.rate_limit_rpm + ' RPM' : 'Default' }} | {{ key.last_used_at ? formatDate(key.last_used_at) : 'Never' }} |
|
Deploy Agent
Deploy a device agent (local AI proxy + machine monitoring for Claude Code, Codex CLI, Cursor, Aider) or a browser extension (web DLP for ChatGPT, Claude.ai, Gemini, Perplexity). The wizard walks you through download, pairing and verification.
How it works: This tab shows all connected clients — device agents (local AI proxy + machine monitoring) and browser extensions (web DLP). Device agents heartbeat their public IP for firewall allowlisting, report MCP inventory, enforce settings policies, and (in monitor+proxy mode) run a local proxy that intercepts Claude Code, Codex CLI, Cursor, Aider, and all AI tools — applying DLP rules before forwarding. They auto-configure shell env vars and detect the logged-on OS user. Extensions intercept web AI (ChatGPT, Claude.ai, Gemini, Perplexity). Agents seen within the last hour are considered online. Blocking any agent immediately stops its access.
Uninstall an Agent
Device Groups
A group holds one device policy (agent config.toml) applied to every member device.
Grouped devices receive the group's policy on their next heartbeat; ungrouped devices keep their own per-agent config.
No groups yet — create one to manage device policy at scale.
Agent Risk Scoring
Registered Agents
No agents registered — IP filtering is disabled
| Name | Type | Group | Upstream | Current IP | Status | Risk Score | Last Seen | Actions |
|---|---|---|---|---|---|---|---|---|
| {{ agent.name }} | Extension Device | — | {{ agent.current_ip || '-' }} | Blocked {{ isAgentOnline(agent.last_seen_at) ? 'Online' : 'Offline' }} |
{{ agent.daily_score }} today · {{ agent.monthly_alert_count }} / 30d
|
{{ agentTimeSince(agent.last_seen_at) }} |
|
Risk Threshold Alerts
{{ agentRiskAlerts.length }}| Agent | Type | Score | Threshold | Time |
|---|---|---|---|---|
| {{ ra.agent_name }} | Global Daily | {{ ra.score }} | {{ ra.threshold }} | {{ formatDate(ra.created_at) }} {{ formatTime(ra.created_at) }} |
MCP Inventory
MCP servers configured across enrolled machines. Secret values are redacted by the agent — only env key names are shown.
mcp-inventory capability on an agent.
| Agent | Client | Server | Transport | Command / URL | Env keys | Scope | Probe |
|---|---|---|---|---|---|---|---|
| {{ s.agent_id }} | {{ s.client }} | {{ s.server_name }} | {{ s.transport }} | {{ s.url || ((s.command || '') + ' ' + (s.args || []).join(' ')) }} | {{ k }} — | {{ s.scope }} | {{ (s.probe_tools || []).length }} tools {{ s.probe_status }} — |
Claude Code Hooks
Hooks configured in Claude Code settings across enrolled machines. Script hooks are fetched view-only and hashed; executable hooks carry a SHA-256 only; inline commands show their config.
hook-inventory capability on an agent.
| Agent | Event | Matcher | Type | Command | Fingerprint | Scope |
|---|---|---|---|---|---|---|
| {{ h.agent_id }} | {{ h.event }} | {{ h.matcher || '*' }} | script executable command |
{{ h.command }}
→ {{ h.command_resolved }}
|
{{ (h.sha256 || '').slice(0, 12) }}… — |
plugin
{{ h.scope }}
{{ h.plugin }}
|
|
{{ h.resolved_path }}
sha256: {{ h.sha256 }}
truncated
{{ h.script_text || '(empty)' }}
|
||||||
{{ spForm.id ? 'Edit Policy' : 'New Policy' }}
Version History & Backups
every save is snapshotted — restore any point| Version | Note | By | When | Action |
|---|---|---|---|---|
| v{{ v.version }} (current) | {{ v.note }} | {{ v.created_by || '—' }} | {{ formatDate(v.created_at) }} {{ formatTime(v.created_at) }} | — |
Inspect prompts in the browser, before they leave the tab
Intercept and check AI prompts on web platforms before submission. Enforces the same DLP rules used by the API firewall.
Extension Activity
{{ alerts.filter(a => a.provider === 'extension').length }} events| Time | User | Rule | Status | Content |
|---|---|---|---|---|
| {{ formatDate(alert.created_at) }} | {{ alert.user_id }} | {{ alert.rule_name }} | Blocked Warned | {{ maskPreview(alert.snippet, 90) }} {{ maskCount(alert.snippet) }} masked injection-shaped |
|
|
||||
|
No extension activity yet |
||||
Install the Extension
Create an Extension agent
Go to the Agents tab, select type Extension, and create. Save the Agent ID and Secret.
Download and load in Chrome
Download the zip, extract it, then go to chrome://extensions then enable Developer Mode and click "Load unpacked" to select the folder.
Connect with Agent ID + Secret
Click the extension icon, enter your server URL, Agent ID, and Agent Secret, then click Connect. No username or password needed.
Monitor and block from the Agents tab
The extension appears as a connected agent. Block it anytime — the user will see a full-page "Access Blocked" overlay on all AI sites within 30 seconds.
How It Works
Intercept
Hooks into the input areas and submit buttons of AI web platforms.
Check
Sends the text to Gatewell for DLP rule evaluation (regex, semantic, presets).
Enforce
Blocks or warns before submission. All interactions logged to the audit trail.
Describe the intercept
Compiled rule
{{ rule.description }}
# {{ rule.pattern_type }} · {{ (rule.side || '').toLowerCase() }} match "{{ rule.pattern }}" action {{ (rule.action || '').toUpperCase() }}
{{ rule.rationale }}
LLM-driven prompt risk scoring
Score every prompt 0.0–1.0 for malicious intent. Threshold-based alert + block.
Scoring Configuration
How it works
e.g. gpt-4o-mini, gpt-4o, gpt-4-turbo e.g. claude-haiku-4-5-20251001, claude-sonnet-4-5-20241022
Score ≥ this triggers an alert (but allows the request)
Score ≥ this blocks the request entirely
Only score prompts with ≥ this many characters
Score Ranges
Test Scoring
Try the LLM scorer with a sample prompt to see how it responds.
{{ llmScoringTestResult.error }}
{{ llmScoringTestResult.explanation }}
Create User
Delete {{ deleteUserTarget.username }}?
This removes the account permanently. Their audit log entries are kept. To keep the account but stop them signing in, use Block instead.
Reset Password for {{ resetPasswordUser.username }}
Gateway settings & integrations
Configure upstreams, SSO, password policy, and review version + diagnostics.
System Status
Console version
{{ systemInfo.version }}
Uptime
{{ formatUptime(systemInfo.uptime_seconds) }}
Python
{{ systemInfo.python_version }}
DB Size
{{ formatBytes(systemInfo.db_stats?.db_size_bytes) }}
Database Records
LLM API Key
This key is used for both LLM Scoring and AI Rule Generator features.
Platform
{{ systemInfo.platform }}
Loading system info...