AI Agents

Route OpenAI, Anthropic, and LangChain calls through CIFP.

AI agents make many HTTP calls to model providers and third-party APIs. CIFP is designed for exactly this use case — agents get proxy credentials, CIFP holds the real API keys.

OpenAI Python SDK

The OpenAI client accepts a custom http_client. Pass an httpxclient configured with the CIFP proxy:

python

import httpx
from openai import OpenAI

proxy_url = "https://user:pass@proxy-abc123.proxy.cifp.vril.dev:3128"

client = OpenAI(
    api_key="{$OPENAI_API_KEY}",   # CIFP will replace this placeholder
    http_client=httpx.Client(proxies={"https://": proxy_url}),
)

response = client.chat.completions.create(
    model="gpt-4o",
    messages=[{"role": "user", "content": "Hello!"}],
)

Anthropic Python SDK

python

import httpx
import anthropic

proxy_url = "https://user:pass@proxy-abc123.proxy.cifp.vril.dev:3128"

client = anthropic.Anthropic(
    api_key="{$ANTHROPIC_API_KEY}",
    http_client=httpx.Client(proxies={"https://": proxy_url}),
)

message = client.messages.create(
    model="claude-opus-4-5",
    max_tokens=1024,
    messages=[{"role": "user", "content": "Hello!"}],
)

LangChain

python

import os, httpx
from langchain_openai import ChatOpenAI

os.environ["HTTPS_PROXY"] = "https://user:pass@proxy-abc123.proxy.cifp.vril.dev:3128"

# LangChain uses requests/httpx under the hood; HTTPS_PROXY is automatically picked up
llm = ChatOpenAI(
    model="gpt-4o",
    openai_api_key="{$OPENAI_API_KEY}",
)

result = llm.invoke("What's 2+2?")

OpenAI Node.js SDK

typescript

import OpenAI from 'openai'
import { HttpsProxyAgent } from 'https-proxy-agent'

const proxyUrl = 'https://user:pass@proxy-abc123.proxy.cifp.vril.dev:3128'
const agent = new HttpsProxyAgent(proxyUrl)

const openai = new OpenAI({
  apiKey: '{$OPENAI_API_KEY}',    // CIFP resolves this
  httpAgent: agent,
})

const completion = await openai.chat.completions.create({
  model: 'gpt-4o',
  messages: [{ role: 'user', content: 'Hello!' }],
})

Recommended Pattern for Agents

Keep the CIFP proxy URL in your agent's environment. The agent never sees real API keys.

bash

# Agent environment — no real API keys!
HTTPS_PROXY=https://proxy-abc123-u1a2b3:password@proxy-abc123.proxy.cifp.vril.dev:3128
NO_PROXY=localhost,127.0.0.1

python

# All HTTP calls automatically route through CIFP
# Use {$VAR} placeholders anywhere you'd normally put a key
import requests
r = requests.post(
    "https://api.openai.com/v1/embeddings",
    headers={"Authorization": "Bearer {$OPENAI_API_KEY}"},
    json={"input": "hello", "model": "text-embedding-3-small"},
)

Firewall Mode for Untrusted Agents

For fully autonomous agents (or agents running user-supplied code), use firewall mode with restrictive CEL rules. For example, to allow only OpenAI and GitHub:

bash

# Rule 1: Allow OpenAI API (priority 10)
request.host == "api.openai.com"

# Rule 2: Allow GitHub API (priority 20)  
request.host == "api.github.com"

# Rule 3: Deny everything else (priority 9999)
true  → action: deny

Any attempt to exfiltrate data to an unexpected host is blocked at the proxy layer — regardless of what code the agent runs.