Deployment Topology

TameFlare uses a cloud proxy model. There is no binary to download, no Docker container to run, no server to manage. The dashboard is hosted at tameflare.com. The gateway runs in the cloud at proxy.tameflare.com.

How the components connect

You (developer)
  │
  │  tf run -- python agent.py
  ▼
┌─────────────────────────────────────────────────────┐
│  proxy.tameflare.com (cloud gateway)                │
│                                                     │
│  1. Identifies gateway by token in proxy auth       │
│  2. Loads connectors + permissions from dashboard   │
│  3. Intercepts all HTTP/HTTPS from your process     │
│                                                     │
│  ┌──────────┐ ┌──────────┐ ┌──────────┐            │
│  │Connectors│ │Permission│ │Credential│            │
│  │ (8 types)│ │ Checker  │ │ Vault    │            │
│  └──────────┘ └──────────┘ └──────────┘            │
│                                                     │
│  domain → connector → parse action → check perms    │
│                                                     │
│  allowed:          inject creds → forward           │
│  denied:           return 403                       │
│  require_approval: hold connection → wait           │
└─────────────────────────────────────────────────────┘
  │                          ▲
  │ HTTPS                    │ Config from dashboard
  ▼                          │
External APIs            tameflare.com
(GitHub, Stripe, ...)    (dashboard)

What runs where

ComponentWhere it runsWhat it does
Dashboardtameflare.com (hosted)Configure gateways, manage connectors/permissions, view traffic, approve requests, manage team
CLI (tf)Your machineSets HTTPS_PROXY env var, spawns your process. No binary download needed.
Cloud gatewayproxy.tameflare.com (hosted)Transparent HTTP/HTTPS proxy. Intercepts traffic, parses actions, checks permissions, injects credentials
Your processYour machineRuns with HTTPS_PROXY set. All outbound traffic routed through cloud gateway

Config sync

The gateway fetches its full configuration from the dashboard:

  1. On startup - GET /api/gateway/config with per-gateway token (gwtk_*)
  2. Every 60 seconds - polls for config updates (new connectors, changed permissions, blocked categories)
  3. Config includes: connectors with credentials, permissions, blocked category deny rules, org kill switch state

If the dashboard is unreachable, the gateway continues operating with its last-fetched config. New config changes won't apply until connectivity is restored.

Network requirements

The gateway needs outbound HTTPS access to:

DestinationPurpose
tameflare.comConfig sync, traffic logging, approval workflow
Your upstream APIs (e.g., api.github.com)Forwarding allowed requests

The cloud gateway is hosted at proxy.tameflare.com. No inbound ports need to be opened on your machine.

What happens when things fail

ScenarioImpactYour process affected?
Dashboard unreachableNo config updates, no new traffic in dashboardNo - gateway uses cached config, proxy continues working
Gateway crashesAll HTTP requests from your process fail (proxy unreachable)Yes - restart with tf run
Internet downGateway can't reach dashboard or upstream APIsYes - all requests fail
Tip
The gateway is designed to be resilient. It caches its config locally and continues enforcing permissions even when the dashboard is temporarily unreachable.

Multiple gateways

You can create multiple gateways in the dashboard, each with different connectors and permissions:

GatewayUse caseConnectors
dev-botDevelopment agentGitHub (allow all), OpenAI (allow all)
deploy-agentCI/CD pipelineGitHub (read only), Slack (allow)
prod-agentProduction agentGitHub (require approval for writes), Stripe (deny deletes)

Each gateway has its own token and runs independently. Use tf init --list to select which gateway to use, then tf run -- <cmd> to proxy traffic.

Next steps