The agent runs where it always did
Your engineers keep using Claude Code exactly as before. No new UI to learn, no workflow change.
Bolt · Agent Gateway
Your coding agents, without the secret leak.
Engineers run Claude Code against real repos and real systems, and every prompt can carry keys, tokens, and customer data straight into a vendor cloud. Bolt's Agent Gateway masks those values on the device before the request leaves, then restores them locally so the work still runs. The category everyone else builds as a network appliance, Bolt builds where the secrets actually live: the client.
Setup
One line, and your agent stops leaking.
Install Bolt, turn on the Agent Gateway, and point Claude Code at the local relay. There is no account, no proxy to deploy, and nothing in front of your network.
export ANTHROPIC_BASE_URL=http://localhost:13020 Run it in the terminal you launch Claude Code from. Setting it for you automatically is not done yet, so this step is still manual.
How it works
Masked out-bound. Restored in place.
Bolt sits on the wire, on the device
A local relay redirects the agent's traffic through Bolt before it reaches any vendor cloud, via config and environment. An OS-level network filter watches the same path and reports what it sees, so you can tell whether anything is routing around the relay.
Secrets and PII are masked out-bound
API keys, tokens, customer records, and structured PII are replaced with reversible placeholders before the request leaves the machine. The vendor model never sees the raw value.
Real values are restored locally
When the agent's tool calls come back to run on your machine, Bolt restores the true values in place. The work still works, but the leak never happened.
The other half
An endpoint your whole company can point at.
The relay above governs agent CLIs that will not accept a custom base URL. Everything else, IDE assistants, internal apps, scripts, and agent frameworks, can simply point at Bolt as their AI endpoint. Same masking, same audit trail, same policy, on infrastructure you own.
Your own AI endpoint, on your own server
bolt-api runs where you put it: a laptop in desktop mode, or your own VPC via Docker or Helm. Point any OpenAI-compatible client at it as the base URL. Nothing about the request reaches us, because there is no us in the path.
SSO instead of API keys
People sign in through your identity provider and receive a token. They never hold a provider API key, so there is no key to leak, share, or walk out of the building. Deprovision in your IdP and access stops.
The models their role permits
A list call returns exactly the models that person is allowed to use. The list and the permission are the same answer, produced by the same code, so they cannot drift apart. Ask for a model your role does not allow and you get a clear refusal naming the administrator who can grant it, never a silent switch to a different model.
Governed the same either way
Masking, the egress gate, restoration, and the audit record apply identically whether the response streams or arrives whole. Which encoding a client asks for is not a security boundary.
Scope we state plainly: the endpoint accepts messages, a model selection, and streaming. Function calling, sampling parameters such as temperature, multiple completions per request, and embeddings are not implemented yet. If your client depends on one of those, tell us and we will test against it before you commit to anything.
Why it's different
An AI gateway that lives on the client, not in front of it.
It governs the coding-agent wire path
The whole 'AI gateway' category assumes a network appliance in front of your own apps. Bolt governs the third-party agent's own outbound traffic, client-side, where the secrets actually are.
Layered, not bypass-by-default
Environment and config redirect is the fast path. The OS network filter observes the same traffic, so a path that skips the relay is visible rather than silent. Defense in depth instead of a single hop an engineer can route around unnoticed.
No new place for your data to sit
The masking happens on the device. Bolt operates no cloud that receives your prompts, so the privacy control is not itself a new exfiltration path.
Fits how engineers already work
Bring your own coding agent. Bolt does not replace Claude Code; it makes it safe to point at sensitive repos and systems.
Where it is today
Shipping honestly, expanding fast.
This is the same coverage list the app shows you in its own settings, so the page and the build cannot drift apart.
- Claude CodeText, tool calls and images
- Gemini CLIAPI-key sign-in
- Gemini CLI, streaming and Google sign-inNot covered yet. This traffic passes through unmasked
- Other CLIsCodex, Devin and others are not supported yet
- Documents and PDFsNot covered yet
Masking is best-effort. The model occasionally rewrites a masked value in a way we cannot reliably restore, for example inside a tool call it composes itself. When that happens the tool call simply will not carry the real value. Nothing is exposed, but it may not work as expected. Structured secrets and PII are masked out of the box; free-text name and entity detection is an optional on-device model you enable per compliance profile.
One honest limitation we publish rather than hide: an unmanaged admin on their own machine can defeat any on-device control. The Gateway is strongest paired with managed policy and the OS network filter: layers, not a single lock.
Point your agents at the sensitive stuff, safely.
See how the Agent Gateway fits with Bolt's boundary masking, governed egress, and tamper-evident audit.