Put a Policy Gateway Between Your Coding Agent and the LLM

Your coding agent talks to a model provider over HTTPS. That connection is a straight line: the agent asks, the provider answers, the answer lands in your editor. Nothing in the middle looks at what came back. For most of what an agent produces, that's fine. For the rest of it — the query built by string concatenation, the API key the model helpfully echoed back into a code sample, the eval() on user input — you find out later, in review, or in a scanner run, or never. This is a walkthrough of putting a policy layer in that line: a local proxy your agent points at instead of the provider, which inspects the response stream and decides allow , redact , or block before the text reaches you. I'll use Cencurity Engine because it's the one I build, it's Apache-2.0, and it runs entirely on your machine. The pattern generalises — if you're building your own gateway, the steps below are still the shape of the problem. What you need first Go installed (the engine is a Go binary you run from source) An API key for whatever provider your agent already uses An agent or IDE that lets you override the API base URL That last one is the real prerequisite. If your tool hardcodes the provider endpoint, none of this applies to it. Most don't: Roo Code, Continue, Claude Code and Gemini CLI all expose a base URL, and anything reading OPENAI_API_BASE will work too. Step 1: Start the gateway Clone the repo, open a terminal in it, and run: go run ./cmd/cast serve \ --listen :8080 \ --upstream https://api.openai.com \ --policy ./cast.rules.example.json Three flags, and each one is doing something you should understand before moving on: --listen is where the gateway accepts traffic. Local only. --upstream is your real provider base URL. Swap it for https://api.anthropic.com , https://api.deepseek.com , https://api.x.ai — whatever you actually use. --policy is the rule file. cast.rules.example.json ships in the repo and is a working starter set, not a placeholder. Note what is not in that com