AI coding tools run with your credentials. Rye is the checkpoint.
Every prompt that leaves a developer machine passes through Rye. Secrets get stripped. Policies enforce. Everything is logged.
Architecture
One control plane between your AI tools and LLM providers
Rye proxies every request. Prompts are scanned, secrets are stripped, policies are enforced — then clean requests are forwarded to the model.
Rye intercepts before the model sees it.
Four things happen on every request. Secret scan. Policy check. Device check. Log write. All before the prompt reaches Anthropic or OpenAI.
Secret scanning
Your developer pastes an AWS key into a prompt. Rye catches it before it hits the model.
Every prompt is scanned for credentials, API keys, connection strings, and PII before being forwarded. The model never sees them.
Policy engine
Someone tries to send your billing logic to an LLM. The request never leaves.
Policies are YAML. Block file paths, restrict which models each team can use, require approval for large context windows. Evaluation adds under 4ms.
Device authorization
A contractor's laptop tries to connect. Rye rejects it before the first token.
Only registered devices route traffic through Rye. Revoke access the moment someone leaves. No API keys to rotate. No tokens to expire.
Audit trail
Every prompt. Every decision. Traced to the developer, device, and timestamp.
Compliance-ready by default. Every interaction is recorded — export to your SIEM, query via API, or browse in the dashboard.
When a customer asks how you govern AI tool usage, you have a specific answer.
Not "we trust our developers." An audit trail, a policy list, and a device registry.
SOC 2 Type II
Every AI interaction logged with identity, device, tool, model, and policy outcome. Export-ready on demand.
ISO 27001
Demonstrate control over what leaves your network. Block sensitive code from reaching any LLM provider.
Vendor questionnaires
"How do you govern AI tool usage?" One answer: link to your Rye policy list and audit log.
Incident response
Trace any AI-generated code change back to the prompt, the developer, the device, and the exact timestamp.
Deployed in minutes.
No workflow changes.
Rye proxies AI tool traffic at the network level. Developers keep their tools. You get the controls.
Install the agent
brew install ryeai/tap/ryeRye starts a local proxy. Your developers change nothing. Their tools connect through it automatically.
Write a policy
block_paths: ["src/billing/**", "infra/**"]Policies are YAML. Block file paths, restrict models, require device registration. They evaluate in under 4ms.
Read the log
rye historyEvery request proxied through Rye appears here — method, status, latency, URI. Export to your SIEM or query via API.