Integration Guide

Connect any AI agent to TameFlare with zero code changes. TameFlare works at the transport layer - it intercepts HTTP traffic via a proxy, so it works with any language, framework, or tool.

Step 1: Create a gateway

Go to tameflare.com/dashboard/gateways and click Create gateway. Name your gateway (e.g. "dev-bot", "ci-agent"), then the wizard walks you through:

1. Connectors - select which APIs this gateway can access (GitHub, OpenAI, Stripe, etc.), paste API keys, test connection
2. Access Rules - per connector: toggle action categories on/off, set per-action overrides (allow / deny / require approval)
3. Notifications - TameFlare dashboard (always on) + optional Slack
4. Review - pre-flight checklist, then click Create gateway

After creation, the dashboard shows your Gateway ID and Gateway Token.

Step 2: Log in and initialize

tf login    # Opens browser - authorize the CLI (one-time per machine)
tf init     # Auto-detects your gateway, saves config

tf login opens your browser to tameflare.com where you click Authorize. Credentials are saved to ~/.tameflare/credentials.json. Then tf init fetches your gateways and selects one (or prompts you to pick if you have multiple).

For CI/CD (headless environments), use the manual approach instead:

tf init --gateway-id gw_xxx --gateway-token gwtk_xxx

Step 3: Run your agent

tf run -- python my_agent.py
tf run -- node my_agent.js
tf run -- ./my_agent

That's it. All outbound HTTP traffic is now routed through proxy.tameflare.com. The agent never sees real API keys.

Step 4: Monitor

Use the CLI or dashboard:

tf status                     # Gateway config + connectivity
tf logs                       # Opens dashboard traffic view

Or use the dashboard at tameflare.com/dashboard for a full view of traffic, approvals, and audit history.

Available connectors

See Connectors for full details on each connector.

Why proxy mode works

• Zero code changes - works with any agent, any language
• Deny-all default - no connector = no access
• Credential isolation - agent never sees real API keys
• Hold-connection approvals - proxy holds HTTP request until human approves
• Strong enforcement - all HTTP/HTTPS traffic is routed through the proxy; for full bypass-resistance, pair with OS-level egress restrictions

Credential vault

When you create a gateway in the dashboard wizard, you paste API keys into the encrypted vault. The gateway injects these credentials into allowed requests at proxy time.

How framework interception works

TameFlare intercepts HTTP traffic at the transport layer, not the framework layer. This means it works with any agent framework without plugins or adapters.

When you run tf run -- python my_agent.py, TameFlare sets HTTP_PROXY / HTTPS_PROXY (and lowercase variants) to https://{token}@proxy.tameflare.com for the child process. Most HTTP libraries respect these variables automatically (see compatibility table below). For full bypass-resistance, pair with OS-level egress controls.

Framework compatibility

Multiple gateways

Create separate gateways in the dashboard for different agents or environments, each with their own connectors and permissions:

# Dev directory - full access gateway
cd ~/dev-agent && tf init --list && tf run -- python dev_agent.py
 
# CI directory - read-only GitHub gateway
cd ~/ci-agent && tf init --gateway-id gw_ci --gateway-token gwtk_xxx && tf run -- ./deploy.sh
 
# Prod directory - approval required for writes
cd ~/prod-agent && tf init --list && tf run -- python prod_agent.py

Each directory has its own .tf/config.yaml pointing to a different gateway. Each gateway has its own token, connectors, and permissions.

Recommended rollout

Troubleshooting

Next steps

• Writing Policies - create custom rules for your domain
• Concepts & Terminology - understand connectors, permissions, and enforcement
• Connectors - full connector reference
• Kill Switch - emergency stop procedures