01
Destructive methods stop here.
GET, HEAD, and OPTIONS pass. POST, PUT, PATCH, and DELETE return a clean 403 before they reach your data.
403Blocked
DELETE /v1/customers/4821
Stopped before upstream
GETHEADPOSTPATCHDELETE
01 Control layer for agent traffic
Your agent can read it. It can’t wreck it.
Put GuardProxy between AI agents and the APIs they use. Reads pass through. Destructive requests stop at the edge.
14-day Pro trial No card required 60-second setup
Request inspector
liveGET
/v1/customers/4821api.example.com
200 allowed
DELETE
/v1/customers/4821api.example.com
403 blocked
RULE 04Write methods
iad · 4msauthorization forwarded in memory
300+edge locations
< 5mstypical overhead
0credentials stored
Any REST APIno SDK required
02 / Product
A narrow blast radius by default.
AI tools should have enough access to do useful work—not enough to turn one bad instruction into an incident.
02
Every block leaves evidence.
Review method, path, upstream, reason, and time without logging secrets or bodies.
09:42:17 DELETE /users/27 09:38:04 PATCH /billing 09:21:33 POST /tokens
03
Your keys stay yours.
Authorization headers move through memory and are never written to our database.
04
Guarded at the edge.
Cloudflare’s global network keeps policy checks close to your agents, so protection adds milliseconds—not a new bottleneck.
300+ edge locations< 5ms typical overhead
Policy live
US West 3msEurope 5msAPAC 4ms03 / Live test
Try the boundary yourself.
Send real requests through a public GuardProxy endpoint. GET reaches the upstream. Write methods do not.
Read traffic continues Write traffic terminates
04 / Setup
Change one URL. Keep everything else.
No agent, SDK, vault migration, or infrastructure project. Your existing key and headers keep working.
Name the upstream
Add the API base URL you want to protect.
api.vendor.comCopy the proxy URL
GuardProxy creates an endpoint for that upstream.
acme.guardproxy.dev/vendorPoint the agent
Replace the base URL. Keep the key and paths.
GET /customers05 / Pricing
Start guarded. Scale when the traffic does.
Every account starts with a 14-day Pro trial. No card, no forced upgrade, and your proxy stays online on Free.
Start the trialDo you store API keys?
No. Authorization headers pass through memory to the upstream and are never written to the database.
Does it work with any API?
Any stable HTTP API works, including REST, GraphQL, and internal services reachable from the public internet.
What about POST-based reads?
Add specific POST paths to an allowlist. Everything outside those narrow exceptions stays blocked.
Can I audit blocked calls?
Yes. The dashboard records method, path, upstream, time, and reason—never the credential or body.
READY WHEN YOUR AGENT IS
Give it access.
Keep the control.
Put a read-only boundary in front of your first API in about a minute.
Protect an API