1
Connect your coding tools
Install the Rye agent. It proxies AI tool traffic without changing developer workflow.
Security for AI coding tools
Secure every AI prompt across your engineering team.
Rye sits between your developers' AI coding tools (Cursor, Windsurf, Claude Code) and LLM providers. Review every prompt, block secrets from leaking, enforce policies, and keep audit trails for compliance.
Installs in under 5 minutes · No workflow changes
rye — acme-engzsh
~/acme $ rye status --workspace acme-eng
12 devs active · 3,841 prompts today
secret-scanning2 blocked
model-allowlistenforced
device-auth1 unregistered
tools: cursor (8) · claude-code (3) · windsurf (1)
~/acme $
⬡Local proxy — runs on your machine
⬡SOC 2 Type II in progress
⬡Self-hosted option available
⚡
<4ms
Policy eval latency
●
99.9%
Enforcement uptime
✗
14K+
Threats blocked last 30d
Architecture
One control plane between your AI tools and LLM providers
Rye proxies every request. Prompts are scanned, secrets are stripped, policies are enforced — then clean requests are forwarded to the model.
Cursor
AI-first code editor
Windsurf
Agentic IDE by Codeium
Claude Code
Anthropic's CLI coding agent
GitHub Copilot
AI pair programmer
rye.ai
Secret scanningPolicy engineThreat detectionDevice authAudit log
OpenAI
GPT-4o, o1
Anthropic
Claude 4, Haiku
Google AI
Gemini 2.5
Outputs
Alerts
Audit log
SIEM export
Webhooks
Live enforcement feedacme-eng workspace
Features
See what happens to every prompt — before it leaves your network
Secret scanning
Your developer pastes an AWS key into a prompt. Rye catches it before it hits the model.
Every prompt is scanned for credentials, API keys, connection strings, and PII before being forwarded. Secrets are redacted or blocked — the model never sees them.
prompt intercepted — secret-scanning3 SECRETS FOUND
1// connect to prod database
2DATABASE_URL=postgres://admin:s3cr3t_pa$$@prod-db.internal:5432/core
3
4aws_access_key_id = AKIAIOSFODNN7EXAMPLE
5aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
6
7STRIPE_SECRET=sk_live_4eC39HqLyjWDarjtT1zdp7dc
Secrets redacted— sanitized prompt forwarded to Anthropic Claude 4
policy evaluation — mrodriguez via CursorBLOCKED
1// billing service — proprietary
2export function calculateMRR(accounts) {
3 const tier = accounts.map(a =>
4 a.plan.price * a.seats
5 );
Policy: no_proprietary_code
Matched path: src/billing/** · Rule: block prompts containing files from protected directories
Policy engine
Someone tries to send your billing logic to an LLM. The request never leaves.
Define which files, directories, and code patterns are off-limits. Set model allow-lists per team. Policies evaluate in under 4ms — developers don't feel the enforcement.
Device authorization
A contractor's laptop tries to connect. Rye rejects it instantly.
Only registered devices can route traffic through Rye. Revoke access the moment someone leaves — no API keys to rotate, no tokens to expire.
device-auth — connection attempt
$ cursor → trying to reach api.openai.com via rye proxy
✓macbook-eng-042authorized
✓macbook-eng-118authorized
✗desktop-contract-017rejected
Connection refused
Device desktop-contract-017 is not registered.
IP 203.0.113.42 · certificate expired · last authorized: Jan 15
audit log — last 60 seconds
SOC 2ISO 27001
14:03:22 ALLOW jchen · cursor → claude-4
prompt: 1,247 tokens · response: 892 tokens · latency: 2.3s
14:03:24 REDACT mrodriguez · claude-code → claude-4
secret: AWS_SECRET_ACCESS_KEY in context (line 42) — redacted, prompt forwarded
14:03:25 BLOCK mrodriguez · cursor → gpt-4
policy: no_proprietary_code · matched: src/billing/mrr.ts
14:03:27 ALLOW akim · windsurf → gpt-4o
prompt: 3,891 tokens · response: 1,204 tokens · latency: 1.1s
Audit trail
Every prompt. Every policy decision. Traced back to the developer and device.
Compliance-ready logs with zero extra work. Every interaction is recorded with full context — export to your SIEM, query via API, or browse in the dashboard.
Compliance
Close security reviews faster
Enterprise customers will ask how you govern AI coding tools. Rye gives you the answer before they ask — audit trails, policy enforcement, and device controls out of the box.
SOC 2 Type II
Every AI interaction logged with identity, device, tool, model, and policy decision. Export-ready.
ISO 27001
Demonstrate control over data leaving your network. Block sensitive code from reaching LLM providers.
Vendor security questionnaires
"How do you govern AI tool usage?" One answer: link to your Rye dashboard.
Incident response
Trace any AI-generated code back to the original prompt, developer, device, and timestamp.
How it works
Deployed in minutes.
No workflow changes.
2
Set security policies
Block secrets, restrict models, scope access per team. Policies evaluate in under 4ms.
3
Monitor and comply
Every interaction logged with identity, device, and policy decision. Export to your SIEM or pull via API.
Your devs are already using AI. Now secure it.
Free for individual developers. No credit card required.
Need a team plan? See pricing · Talk to us