The agent runs where it always did
Your engineers keep using Claude Code exactly as before. No new UI to learn, no workflow change.
Bolt · Agent Gateway
Your coding agents, without the secret leak.
Engineers run Claude Code against real repos and real systems, and every prompt can carry keys, tokens, and customer data straight into a vendor cloud. Bolt's Agent Gateway masks those values on the device before the request leaves, then restores them locally so the work still runs. The category everyone else builds as a network appliance, Bolt builds where the secrets actually live: the client.
Setup
One line, and your agent stops leaking.
Install Bolt, turn on the Agent Gateway, and point Claude Code at the local relay. There is no account, no proxy to deploy, and nothing in front of your network.
export ANTHROPIC_BASE_URL=http://127.0.0.1:13020/bolt/<your-key>
The key is generated per install, so the exact line is in Bolt itself, under Settings, AI Models, Agent Gateway, with a Copy button beside it. Claude Code started from Bolt is routed for you; for a Claude Code you start yourself, run this line in the terminal you launch it from. The Gemini CLI takes GOOGLE_GEMINI_BASE_URL the same way. Codex is the exception: it is redirected by a line in ~/.codex/config.toml, which Connect Codex in the same screen writes for you, because the environment variable several published guides recommend is not read by the shipped Codex binary. We checked the binary rather than repeat the guides.
The key is what stops anything else on your machine from driving your relay and reading the restored, unmasked output. A request without it is refused, and the refusal tells you where to find the real one.
How it works
Masked out-bound. Restored in place.
Bolt sits on the wire, on the device
A local relay redirects the agent's traffic through Bolt before it reaches any vendor cloud, via config and environment.
Secrets and PII are masked out-bound
API keys, tokens, customer records, and structured PII are replaced with reversible placeholders before the request leaves the machine. The vendor model never sees the raw value.
Real values are restored locally
When the agent's tool calls come back to run on your machine, Bolt restores the true values in place. The work still works, but the leak never happened.
The other half
An endpoint your whole company can point at.
The relay above governs agent CLIs that will not accept a custom base URL. Everything else, IDE assistants, internal apps, scripts, and agent frameworks, can simply point at Bolt as their AI endpoint. Same masking, same audit trail, same policy, on infrastructure you own.
Your own AI endpoint, on your own server
bolt-api runs where you put it: a laptop in desktop mode, or your own VPC via Docker or Helm. Point any OpenAI-compatible client at it as the base URL. Nothing about the request reaches us, because there is no us in the path.
SSO instead of API keys
People sign in through your identity provider and receive a token. They never hold a provider API key, so there is no key to leak, share, or walk out of the building. Deprovision in your IdP and access stops.
The models their role permits
A list call returns exactly the models that person is allowed to use. The list and the permission are the same answer, produced by the same code, so they cannot drift apart. Ask for a model your role does not allow and you get a clear refusal naming the administrator who can grant it, never a silent switch to a different model.
Governed the same either way
Masking, the egress gate, restoration, and the audit record apply identically whether the response streams or arrives whole. Which encoding a client asks for is not a security boundary.
Scope we state plainly: the endpoint accepts messages, a model selection, and streaming. Function calling, sampling parameters such as temperature, multiple completions per request, and embeddings are not implemented yet. If your client depends on one of those, tell us and we will test against it before you commit to anything.
Why it's different
An AI gateway that lives on the client, not in front of it.
It governs the coding-agent wire path
The whole 'AI gateway' category assumes a network appliance in front of your own apps. Bolt governs the third-party agent's own outbound traffic, client-side, where the secrets actually are.
Layered, not bypass-by-default
Environment and config redirect is the fast path. An OS network filter that would show a path skipping the relay is built but not in current releases.
No new place for your data to sit
The masking happens on the device. Bolt operates no cloud that receives your prompts, so the privacy control is not itself a new exfiltration path.
Fits how engineers already work
Bring your own coding agent. Bolt does not replace Claude Code; it makes it safe to point at sensitive repos and systems.
Where it is today
Shipping honestly, expanding fast.
Rechecked against the relay's own code on 20 October 2026: three vendor wire formats, and the gaps named rather than rounded up.
- Claude CodeText, tool calls and images, buffered and streaming
- Gemini CLI, API-key sign-inBuffered and streaming
- CodexThe OpenAI Responses wire format, buffered and streaming, through the Connect Codex setting
- Gemini CLI, Google sign-inBuffered and streaming
- Other CLIsDevin and others are not supported yet
- Documents and PDFsUnder a company policy, a file Bolt cannot mask is held, not sent. For personal use, text inside the file is not masked
Outbound is fail-closed. A content block this relay has not been taught is masked rather than forwarded, and an image it cannot screen is refused rather than sent. Structured secrets and PII are masked out of the box; free-text name and entity detection is an optional on-device model you enable per compliance profile.
The return leg is best-effort. The model sometimes rewrites a masked value in a way we cannot reliably restore, for example inside a tool call it composes itself. The call then arrives without the real value. Nothing was exposed, because the model only ever saw the mask, but the call may not do what you expected.
One honest limitation we publish rather than hide: an unmanaged admin on their own machine can defeat any on-device control. The Gateway is strongest paired with managed policy: layers, not a single lock.
Point your agents at the sensitive stuff, safely.
See how the Agent Gateway fits with Bolt's boundary masking, governed egress, and tamper-evident audit.