Docs

Secure AI coding agents with Rye.

Rye sits outside Claude Code, Codex CLI, Cursor, Windsurf, and other coding assistants. It supervises the local process, routes model traffic through a policy-aware proxy, and keeps an audit trail security teams can actually use.

First command

curl -fsSL https://storage.googleapis.com/barn.rye.ai/install.sh | sh

Policy enforcement

Block secrets, restrict model/API destinations, cap oversized payloads, and apply centrally managed policy before model traffic leaves the workstation.

Agent audit trail

Capture request/response metadata, model traffic, approval events, wrapped process lifecycle, file changes, and assistant session history.

App shims

Use `rye app wrap claude` and `rye app wrap codex` to make common CLIs start under Rye automatically from the developer's normal shell.

Local diagnostics

Use `rye doctor`, `rye status`, `rye history`, and `rye app doctor` to verify auth, daemon state, proxy routing, CA trust, and captured traffic.

Quickstart

From install to supervised agent session.

Start free trial

Install Rye

Install the local CLI and daemon on a developer workstation. Rye runs beside the AI coding tools your team already uses.

curl -fsSL https://storage.googleapis.com/barn.rye.ai/install.sh | sh

Authenticate

rye auth login

Start supervision

Start the local proxy and install the CA needed for HTTPS model traffic inspection.

rye up --install-ca --intercept-patterns openai.com,anthropic.com,claude.com,chatgpt.com,cursor.com,windsurf.com

Wrap an agent

Run Claude Code, Codex CLI, or another coding assistant through Rye so proxy settings, CA trust, process telemetry, and file-change monitoring are applied together.

rye wrap claude
rye wrap codex

Command reference

The commands teams use day to day.

These are the local controls for setup, diagnostics, supervision, and audit review. Use `rye --help` or `rye up --help` for the full CLI surface.

rye status

Show daemon, proxy, policy, and device state.

rye doctor

Diagnose auth, CA, proxy, DNS, gRPC, and app shim setup.

rye history --last 1h

Inspect captured proxy traffic from the last hour.

rye app wrap claude

Install a shim so `claude` runs under Rye supervision.

rye app wrap codex

Install a shim so `codex` runs under Rye supervision.

rye down

Stop the local proxy and restore proxy settings.

Learn the model