Rye supervision workbench
Proxy and CA
Configure Rye's local proxy, install CA trust, and route model API traffic through the policy engine.
route
/docs/config/proxy
control point
external supervisor
signals
proxy / policy / audit
01Claude / Codex
02Rye local proxy
03policy + audit
04model API
Start the proxy
Use:
exec:bash
rye up --install-ca --intercept-patterns openai.com,anthropic.com,claude.com,chatgpt.com,cursor.com,windsurf.com
The proxy becomes the control point for model API traffic. The CA installation allows Rye to inspect HTTPS model requests from supervised tools.
Intercept patterns
Intercept patterns define which hosts should route through Rye. Keep the list narrow enough to avoid surprising unrelated traffic, but broad enough to include the model providers and agent vendors your team uses.
Common entries include:
exec:text
openai.com
anthropic.com
claude.com
chatgpt.com
cursor.com
windsurf.com
Verify routing
Run:
exec:bash
rye doctor
exec:bash
rye history --last 15m
rye doctor verifies local setup. rye history confirms that supervised requests are reaching Rye.
Stop the proxy
Use:
exec:bash
rye down
This stops the local proxy and restores proxy settings managed by Rye.
Common mistakes
- Starting the agent before proxy variables are set.
- Installing CA trust in one runtime but launching the agent from another.
- Proxying the entire workstation during tests instead of using targeted intercept patterns.
- Assuming the agent's own permission prompts are a substitute for network policy.