coding-agents

Coding agents behind the gateway

Points OpenAI-compatible coding agents (Aider, Continue, Cursor) at the AxioRank Gateway so every completion they request is guarded locally and lands in a signed, hash-chained receipt log. It is also honest about which tools cannot ride an OpenAI-compatible proxy today, and what to use for those instead.

The gateway is a pass-through: your provider key rides the Authorization header on each call and is forwarded upstream, never stored. With no config file it proxies straight to OpenAI, so any agent that already talks to api.openai.com/v1 keeps working when you swap the base URL.

Setup

Start the gateway (no config needed for the OpenAI pass-through case):

npx @axiorank/gateway

It serves an OpenAI-compatible endpoint at http://localhost:8787/v1. To route to other providers (Groq, Cerebras, Ollama, 34 presets total) or add failover, drop an axiorank.gateway.json next to it; see axiorank.gateway.example.jsonc for the full reference. A route alias you define there becomes the model name your agent uses.

No key handy? npx @axiorank/gateway demo runs a fully offline demo, no key and no network.

Which agents work

Anything that lets you override an OpenAI-compatible base URL works. Tools that speak a different wire protocol do not, and pretending otherwise would just waste your afternoon.

Tool	How to point it at http://localhost:8787/v1	Caveat
Aider	export OPENAI_API_BASE=http://localhost:8787/v1 then aider --model openai/<model>	Keep the openai/ prefix on the model name so Aider treats it as an OpenAI-compatible endpoint.
Continue	In config.yaml: provider: openai with apiBase: http://localhost:8787/v1	Requests come from your editor, so localhost works as is.
Cursor	Cursor Settings, Models: set "Override OpenAI Base URL" and your API key	Cursor routes custom-key requests through its own servers, so localhost is not reachable. The gateway must be on a URL Cursor's backend can reach (a deployed instance or a tunnel). Chat models only; Tab autocomplete stays on Cursor's backend.
Codex CLI	Does not work today	Codex's custom model_providers config documents wire_api = "responses" as the only supported value (config reference). The gateway serves /v1/chat/completions, not the Responses API. Use coding-guard instead.
Claude Code	Does not work	Claude Code speaks Anthropic's Messages wire, not OpenAI chat completions. Use coding-guard instead.

Setting names above were checked against each tool's docs in July 2026. They do change; if one stops working, the docs linked in the table are the source of truth.

Run: Aider, end to end

export OPENAI_API_BASE=http://localhost:8787/v1
export OPENAI_API_KEY="$OPENAI_API_KEY"   # your real key; forwarded, never stored
aider --model openai/gpt-4o-mini

Aider now works exactly as before, except every prompt passes the gateway's local guardrails (prompt mode block, completion mode redact) and every response appends a receipt to ~/.axiorank/gateway/receipts.jsonl.

Run: Continue, config block

Add a model to your Continue config.yaml:

models:
  - name: GPT-4o mini via AxioRank
    provider: openai
    model: gpt-4o-mini
    apiBase: http://localhost:8787/v1
    apiKey: ${{ secrets.OPENAI_API_KEY }}

Expected output

Coding agents stream, and streamed responses do not carry the full receipt header, so the quickest way to see what the gateway adds is one non-streamed smoke call shaped like agent traffic:

curl -sS -D - http://localhost:8787/v1/chat/completions \
  -H "authorization: Bearer $OPENAI_API_KEY" \
  -H 'content-type: application/json' \
  -d '{"model":"gpt-4o-mini","messages":[{"role":"user","content":"Write a one-line commit message for a typo fix."}]}'

HTTP/1.1 200 OK
x-axiorank-risk: 50
x-axiorank-receipt-id: 2b7d1f4a-9c03-48e1-b6f2-8a5d0c3e7f19
x-axiorank-receipt: eyJyZWNlaXB0VmVyc2lvbiI6MSwia2luZCI6ImF4aW9yYW5rLWdhdGV3YXktcmVjZWlwdC12MSI...

{"id":"chatcmpl-...","object":"chat.completion","model":"gpt-4o-mini","choices":[{"index":0,"message":{"role":"assistant","content":"fix: correct typo in README"},...}]}

If an agent ever ships something it should not (say, a live API key pasted into a prompt), the call comes back as 403 with "type": "axiorank_blocked" in the error JSON and never reaches the provider.

Streamed calls (the normal agent case) still write receipts; they just skip the header. Verify the whole chain offline at any time:

npx @axiorank/gateway verify ~/.axiorank/gateway/receipts.jsonl

receipt chain valid (14 receipts, key kQ2mZx8v)

The verifying public key is published at http://localhost:8787/.well-known/axiorank/jwks.json and via npx @axiorank/gateway keys.

Tools that do not speak OpenAI's wire

Claude Code (Anthropic Messages API) and Codex CLI (Responses API for custom providers) cannot ride a chat-completions proxy, and no base URL trick changes that. For those, AxioRank governs the agent from the other side: @axiorank/coding-guard hooks into Claude Code, Cursor, Codex, and GitHub Copilot CLI to block dangerous tool calls locally and offline (destructive commands, secret exfiltration, prompt-injected tool results), with an optional signed Coding Session Seal per session.