proxy_guidance
Get instructions to run the transparent capture proxy, including its chokepoint limitations and request scanning behavior.
Instructions
[READ] How to run the transparent capture proxy, and what it does NOT guarantee.
WRITES NOTHING and starts no listener — it composes the ai-guardian proxy serve command plus the client-side change, and returns the caveat that
matters: the proxy is a CHOKEPOINT, not an enforcement boundary. Any client
that can still reach the runtime's real port bypasses it entirely, and this
tool cannot detect that. Captured traffic is a sample, not the population,
until the runtime is unreachable except through the proxy.
Requests are scanned before forwarding; responses stream through uninspected, because buffering them would turn every streaming client into a blocking one. A governed request whose body cannot be parsed is refused, not forwarded.
Args: listen_host: Address the proxy would bind. listen_port: Port the proxy would bind (default 11435). target: Runtime target from config; omit for the default.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| target | No | ||
| listen_host | No | 127.0.0.1 | |
| listen_port | No |