Skip to content
Brutor AI Docs

Coding Agents Through the Gateway

Coding agents and CLIs are ordinary API clients: they read a base URL and an API key from the environment. Point those at the gateway and — without touching the tool itself — every request they make is governed, metered, and audited like any other workload.

Why this matters: developer AI traffic is usually the least visible spend and the most likely to carry source code and secrets to a third-party API. Behind the gateway it gets:

  • Cost attribution — per developer / team / model in Mission Control
  • Secrets guardrails — block AWS keys, GitHub tokens, private keys from egressing in prompts
  • Budgets — RPM / daily-token / dollar caps per team (Limits)
  • Audit — who sent what to which model, when (Logs)
  • Failover & model policy — routing groups decide which models a team may burn

Claude Code

Section titled “Claude Code”

Claude Code honors ANTHROPIC_BASE_URL, and the gateway serves the native Anthropic Messages API at /v1/messages (plus /v1/messages/count_tokens) — no /proxy/ prefix, no translation layer. The Anthropic SDK’s x-api-key header is accepted as a Brutor API key carrier:

Terminal window
export ANTHROPIC_BASE_URL="http://localhost:8100"
export ANTHROPIC_API_KEY="sk_brutor_api_..."   # a Brutor key, not an Anthropic key


claude   # every model call now goes through the gateway

The gateway resolves sk_brutor_api_... to your resource group, picks the configured Claude model (the group’s Anthropic provider key lives server-side, encrypted), applies guardrails and limits, then forwards to Anthropic. Blocks come back Anthropic-shaped so the CLI renders them cleanly:

{
  "type": "error",
  "error": {
    "type": "invalid_request_error",
    "code": "guardrail_blocked",
    "message": "Secrets detected in input: aws_access_key",
    "guardrail": "Engineering Baseline",
    "check": "secrets",
    "direction": "input"
  }
}

Rate limits arrive as Anthropic rate_limit_error with a Retry-After header, so Claude Code’s built-in backoff behaves correctly.

Any OpenAI-compatible CLI

Section titled “Any OpenAI-compatible CLI”

Most CLIs and coding agents that speak the OpenAI API honor OPENAI_BASE_URL (or an equivalent flag/config field):

Terminal window
export OPENAI_BASE_URL="http://localhost:8100/v1/proxy/llm"
export OPENAI_API_KEY="sk_brutor_api_..."

That covers anything built on the OpenAI SDKs — chat, completions, responses, and embeddings all resolve against the models your key’s resource group allows. Tools with their own config files work the same way; wherever the tool asks for an “OpenAI base URL” or “API endpoint”, give it http://localhost:8100/v1/proxy/llm.

Quick verification that a tool is actually going through the gateway:

Terminal window
curl -s $OPENAI_BASE_URL/models -H "Authorization: Bearer $OPENAI_API_KEY"
# → the model list is YOUR governed list, not the provider's full catalog

Then run the CLI and watch the request appear in Mission Control → Usage.

MCP tools in coding agents

Section titled “MCP tools in coding agents”

Coding agents that support MCP (Claude Code, Goose, Cursor, …) can also take their tools through the gateway — add the governed MCP endpoint as a server. For Claude Code:

Terminal window
claude mcp add --transport http brutor-tools \
  http://localhost:8100/v1/proxy/mcp/mcp-01KS2MQQS24X355MN7NK006Y28 \
  --header "Authorization: Bearer sk_brutor_api_..."

See Use MCP tools through the gateway for Claude Desktop, Goose, and SDK configs, and Virtual MCP for a single endpoint aggregating every governed tool.

What this does — and does not — govern

Section titled “What this does — and does not — govern”

Be precise about the boundary:

  • Governed: any client whose base URL points at the gateway — Claude Code, an OpenAI-compatible CLI, curl, your agents, internal apps, custom portals. Their traffic transits the gateway, so guardrails, budgets, and audit apply.
  • Not governed: the consumer ChatGPT and Claude apps themselves. Their traffic goes straight to the vendor and never touches your gateway — that’s the domain of network/CASB controls and the vendors’ own admin consoles. (Brutor can observe that spend by importing vendor admin telemetry — see Traffic Data Import in Mission Control — but observability is not enforcement.)

The practical rollout pattern for engineering orgs: issue team API keys, set ANTHROPIC_BASE_URL/OPENAI_BASE_URL in the standard dev environment (dotfiles, devcontainers, CI images), and revoke direct provider keys. From that moment, developer AI traffic is governed by construction.

Section titled “Related”