Rye documentation

What Rye does

Rye supervises AI coding tools from outside the assistant. It runs beside Claude Code, Codex CLI, Cursor, Windsurf, and similar tools, then gives your team a policy and audit layer that is not owned by a single agent runtime.

The operating model is simple:

1. A developer starts Rye on their workstation.
2. Rye authenticates the device and user to a workspace.
3. AI coding tools are launched through Rye or configured to route model traffic through Rye.
4. Rye evaluates model traffic against workspace policy before it leaves the machine.
5. Rye records policy decisions, request metadata, local process context, and audit events.

Quickstart

Install the CLI:

Or use Homebrew:

Authenticate:

rye auth login

Start supervision:

rye up --install-ca --intercept-patterns openai.com,anthropic.com,claude.com,chatgpt.com,cursor.com,windsurf.com

Wrap the agent you want to supervise:

rye wrap claude

rye wrap codex

Core concepts

Local proxy

The proxy is the network control point. It sees model API traffic, applies policy, records audit metadata, and forwards allowed requests to the upstream provider.

Device identity

Device identity ties a local machine to a workspace. That gives security teams a way to revoke a workstation without rotating every model API key a developer may have used.

Policy evaluation

Policy is evaluated centrally and applied locally. Common controls include secret detection, model allow-lists, protected path rules, request size caps, and workspace-scoped restrictions.

Audit trail

The audit trail records what happened, who initiated it, what device ran it, what tool was involved, which policy matched, and whether the request was allowed, redacted, or blocked.

Where to go next

Start with installation, then configure authentication and the proxy. Once traffic is flowing, define policy and use the CLI reference for day-to-day operations.