CIFP is a multi-tenant SaaS forward proxy that injects real credentials at the wire level. Configure secrets through a Vercel-style dashboard, send requests with {$TOKEN} placeholders, and let CIFP handle the rest.
No SDK required. Works with any HTTP client, any language, any AI framework.
# Point your agent at CIFP — nothing else changes
import os, requests
# Set once — works for every request automatically
proxies = {"https": "http://your-proxy.fly.dev:3128"}
# Use {$TOKEN} placeholders — CIFP injects the real key
r = requests.get(
"https://api.github.com/repos/me/private",
headers={"Authorization": "Bearer {$GITHUB_PAT}"},
proxies=proxies
)
# Real token was injected — your code never touched it ✓Every CIFP proxy runs in one of two modes. Most people start with Auto-Auth. Reach for Firewall when you need full control over what your code is allowed to do.
Everyday use & quick integration
Add a {$SECRET_NAME} placeholder to any request header. CIFP replaces it with the real credential before the request leaves the proxy. No TLS interception. No CA cert. No code changes beyond switching your proxy URL.
AI agents & automated workflows
Full TLS interception. CIFP decrypts every outbound HTTPS request, evaluates it against your CEL rule set, injects credentials automatically, and re-encrypts before forwarding. Your code sends requests normally — no placeholders needed.
From simple credential injection to full MITM inspection and private DNS filtering — CIFP handles the entire security surface of your agent's outbound traffic.
The everyday path. Drop a {$TOKEN} placeholder into any header. CIFP swaps in the real credential at the wire level — your code never sees the secret.
Secrets are encrypted with AES-256-GCM at rest and never returned over the API. They exist only inside your proxy machine.
For AI agents and automated pipelines. CIFP intercepts every HTTPS request, evaluates it against your CEL rules, and either allows, blocks, or holds it for human review.
Write ALLOW / DENY / HOLD rules in Google CEL. Rules compile at save-time, not runtime. Human-in-the-loop approval is built in.
Each proxy is a dedicated, isolated VM in the region of your choice. Provision, pause, resume, or destroy via API or dashboard in seconds.
Every action available in the dashboard is also available via REST API. Manage proxies, secrets, rules, and logs from your own tooling.
Route proxy traffic through our privacy-first DNS resolver. Blocks ads, trackers, and malware domains at the DNS layer — before the request is made.
Subscribe to curated blocklists (OISD, StevenBlack, URLhaus) or add your own custom blocked domains per proxy. Syncs automatically every 24 h.
CIFP DNS automatically blocks high-entropy domain labels that indicate DGA malware, DNS tunnelling, and data exfiltration attempts.
No infrastructure to manage, no SDK to install. CIFP is a standard HTTP proxy — it works with every language and framework that supports proxy environment variables.
Pick a region, choose auto-auth or firewall mode, and click Create. Your dedicated VM is up in ~5 seconds.
Paste API keys, tokens, and passwords into the secrets panel. They are encrypted with AES-256-GCM at rest immediately.
Set http_proxy / https_proxy to your proxy URL. Use {$SECRET_NAME} as the placeholder wherever credentials belong.
Every outbound request has real credentials injected at the wire level. Your agent code stays clean, and your secrets stay safe.
Route your proxy's DNS through our self-hosted resolver. Block ads, trackers, and malware at the DNS layer before requests are even made. Shannon-entropy detection catches DGA malware and DNS tunnelling automatically. Per-proxy custom blocklists, synced in real-time via short-lived JWTs with zero-downtime key rotation.
Start with a $5 Test Drive — 3 days of full access. Billing powered by Whop.