Request a pilot
Skilak MeshGet Mesh

Setup per client

Exact configuration for each supported AI client.

This document is a companion to AI-FLOW-COVERAGE.md. It provides a per-client setup reference covering the same clients as website/src/data/coverage.ts. It is hand-maintained — there is no generator, so the two are coupled only by convention. When one changes, change the other. The full matrix, network-enforcement layers, and architectural rationale live in AI-FLOW-COVERAGE.md, which is authoritative if this file disagrees with it.

The coverage rule

Skilak Mesh can protect a client you point at a custom API base URL when the complete request reaches the gateway in a representation it can fully enumerate. For an OpenAI- or Anthropic-compatible client, set its custom base URL (OPENAI_BASE_URL / ANTHROPIC_BASE_URL) to the mesh’s alias path — http://localhost:51737/p/openai/v1 or http://localhost:51737/p/anthropic. If it only talks to the vendor’s own cloud with no custom-endpoint option, it’s Block & route — block it at egress and use an approved routed client instead.

The /p/<alias>/ prefix is required: the alias is the only thing that selects an upstream, and a bare http://localhost:51737 base URL is refused with unknown_provider_alias. Aliases are pinned in config/skilak.yaml. The client keeps and sends its own provider credential; the mesh relays it to the pinned provider and holds none of its own.

Coverage capability is not current client state. smesh client list reports installed, supported, configured, connected, gateway healthy, and protected now separately. A config file is not evidence that an app is installed, connected, or protected. Connected and protected now remain not verified until current evidence supports them.

Only two automatic adapters ship: Claude Code CLI settings and the shared Codex configuration used by Codex CLI and Codex in VS Code. Gemini CLI, AGY, AnythingLLM Desktop, and other compatible clients require manual, version- verified setup. Installed unsupported clients remain visible with the reason and an approved routed alternative.

For a configuration-free foreground trial, start the mesh and run:

smesh run claude
smesh run -- <another-command> [args...]

This injects sessionized OpenAI and Anthropic base URLs only into the launched process and does not edit client configuration. Skilak Mesh reports go to stderr; child stdout and its exit status remain intact. An observed request earns path coverage for that session. Client coverage is a separate inventory claim: Claude Code CLI’s normal base-URL mode is verified, Cursor remains incomplete because its indexing and tab-completion traffic uses Cursor’s own backend, and unknown tools get path coverage only. Zero observed traffic warns that the tool may ignore base-URL environment variables. No argv, environment, prompt, credential, working directory, or command output is stored.

Managed client lifecycle

Connect previews before applying and names every affected application or integration. The Codex preview names both Codex CLI and Codex in VS Code when detected because they share configuration.

smesh client disconnect all
smesh client pause
smesh client resume

Disconnect all restores every managed client atomically and reports restored, already-direct, conflicted, and failed clients. Pause restores direct routes, waits for affected clients to restart or routed traffic to cease, and only then stops the gateway. Resume starts the gateway, proves real health, and reroutes only previously approved clients. Fully quit and restart affected CLIs and apps after any route change; /clear and a new chat do not reload saved configuration. Saved direct settings do not prove routed traffic has stopped. For a changed owned setting, use --accept-current to keep the newer value or --restore-prior to restore the recorded earlier value.

What “protected” means in this document

Read every What’s protected line below with this scope, which applies without exception:

  • Outbound requests are inspected and policy-enforced before they are forwarded — prompts, message content, tool/schema text, and supported request-contained files and images. Findings can block, redact, warn, or allow, and every decision is written to a payload-free audit event.
  • Provider responses are relayed to the client unmodified and are not content-inspected. No content rule runs against a response body, a response header, an SSE stream, a provider WebSocket event, or a downloaded file. Codex WebSocket provider events are bounded and structurally validated as JSON text before relay; that is not content inspection. A successful POST /files response is bounded and parsed only to mint one file-ID attestation; invalid metadata can therefore fail the upload call without becoming content inspection.
  • Skilak Mesh is not an output filter. It does not moderate, sanitize, or rewrite what a model returns. If your requirement is controlling model output, this product does not meet it.
  • Known-route query strings are forwarded unchanged. On an unknown route, the path segments and query string are scanned as request text. It must be bodyless with no unsupported declaration or carry a registered, fully enumerable representation.
  • The mesh sees only what a client is configured to send through it; local tools, shells, and direct network calls are separate boundaries.

Supported traffic routed through the mesh has its outbound requests inspected; managed egress policy blocks known direct AI paths.

Supported routing modes

Codex CLI and Codex in VS Code

  • Category: CLI / IDE integration
  • What’s protected: HTTP requests plus each complete JSON text response.create message on the exact OpenAI /v1/responses WebSocket transport; prompts, tool/schema text, and tool results are inspected before provider transmission. Responses are relayed without content inspection.
  • Setup: Start the gateway, then run smesh client connect codex --apply. Before it writes the shared Codex configuration, the connector proves gateway health, opens two authenticated loopback sockets, and sends captured-shape synthetic prewarm and fresh-turn envelopes through the real inspection path. It makes no provider call.
  • Config: ~/.codex/config.toml: openai_base_url = "http://127.0.0.1:51737/p/openai/v1"
  • Caveat: The shared file can affect both Codex CLI and Codex in VS Code; its existence proves neither is installed or connected, and affected surfaces require a full restart. WebSocket support requires the observed OpenAI-Beta: responses_websockets=2026-02-06 JSON text protocol. Binary, audio, opaque, malformed, and other Realtime traffic is refused. Compatibility requires floors of two sockets, 64 KiB per message, 256 KiB per session, 32 messages, 60 seconds, and a 64 KiB upstream fragment. A failed preflight reports Codex unsupported and leaves the prior config untouched; if a previously managed route is already present, its saved config is restored automatically. Filesystem reads and shell commands remain outside the mesh.

Claude Code CLI

  • Category: CLI
  • What’s protected: Outbound model prompts and compatible attachments (requests only; responses are relayed)
  • Setup: The shipped adapter previews and updates Claude Code CLI settings only after gateway health is proven. Run smesh client connect claude --apply, or export both ANTHROPIC_BASE_URL=http://localhost:51737/p/anthropic and ENABLE_TOOL_SEARCH=true, then run Claude Code with its existing authentication.
  • Config: ANTHROPIC_BASE_URL=http://localhost:51737/p/anthropic; ENABLE_TOOL_SEARCH=true
  • Context safety: Claude Code 2.1.235 disables tool search at a custom base URL unless it is explicitly enabled. Without it, every configured MCP schema is loaded into the first request. Connector apply writes ENABLE_TOOL_SEARCH=true; the run wrapper refuses conflicting environment or user settings. The gateway also refuses identified Claude Code traffic that lacks the verified advanced-tool beta, covering later project/local settings, CLI deny flags, and --bare. Remove the override and start a fresh session rather than deleting MCP tools.
  • Protocol: Claude Code owns beta negotiation. In the verified 2.1.235 flow it sends advanced-tool-use-2025-11-20, a deferred-tool placeholder, and later a tool_reference; the mesh preserves those request and response blocks without modification.
  • Verified capture: With an empty current folder and 20 synthetic global MCP tools, the first custom-base request was 124,323 bytes with 43 tools and all 20 MCP schemas when the setting was absent. With ENABLE_TOOL_SEARCH=true, it was 85,773 bytes with 9 tools and no MCP schema; selecting one tool produced an 86,648-byte request with that one deferred schema. Wire bytes diagnose schema loading but are not context-token measurements.
  • Fresh-session budget: Before release, compare at least five alternating direct and routed sessions in the same time window, with the same CLI version, model, effort, prompt, network, and fresh-session procedure. Routed context must be no more than one percentage point above direct and no more than 5% absolute. Provider-reported input plus cache-creation plus cache-read tokens must be no more than 5% above direct. Report p50, p95, and p99; a miss keeps the Claude route out of release.
  • Caveat: Saved settings are not connection evidence. Fully restart Claude Code CLI after changes. Local tools (filesystem, shell) need a separate sandbox; they do not pass through the mesh.

Aider

  • Category: CLI
  • What’s protected: Outbound chat/code context sent to the model (requests only; responses are relayed)
  • Setup: Configure Aider’s compatible base URL and your provider key: OPENAI_BASE_URL=http://localhost:51737/p/openai/v1 and OPENAI_API_KEY= (or the Anthropic equivalent).
  • Config: OPENAI_BASE_URL=http://localhost:51737/p/openai/v1
  • Caveat: File edits and shell/git commands Aider runs locally are outside the gateway.

Cline

  • Category: IDE-extension
  • What’s protected: Outbound model calls and supported attachments (requests only; responses are relayed)
  • Setup: Select a compatible/BYOK provider in Cline and point its base URL at the mesh (http://localhost:51737/p/openai/v1) with your provider key.
  • Config: OpenAI-compatible Base URL = http://localhost:51737/p/openai/v1
  • Caveat: Browser, terminal, and MCP actions Cline performs are separate and not protected by the mesh.

Continue

  • Category: IDE-extension
  • What’s protected: Outbound chat, edit, and completion requests (requests only; responses are relayed)
  • Setup: Set the model provider apiBase in Continue’s config to the mesh (http://localhost:51737/p/openai/v1) with your provider key.
  • Config: model apiBase: http://localhost:51737/p/openai/v1
  • Caveat: Continue’s local context providers and tool actions are not inspected by the mesh.

Open WebUI

  • Category: web-app
  • What’s protected: Outbound chat and request-contained images/files (requests only; responses are relayed)
  • Setup: Configure its OpenAI-compatible endpoint to the mesh: set the OpenAI API Base URL to http://localhost:51737/p/openai/v1 with your provider key. A strong candidate for the approved local UI.
  • Config: OpenAI API Base URL = http://localhost:51737/p/openai/v1
  • Caveat: Provider files are enabled by default and require inspection or an explicit expiring waiver plus a current file-ID attestation; other provider-storage categories default off.

LibreChat

  • Category: web-app
  • What’s protected: Outbound compatible model requests and supported request attachments (requests only; responses are relayed)
  • Setup: Configure provider endpoints in librechat.yaml to the mesh (baseURL: http://localhost:51737/p/openai/v1) with your provider key.
  • Config: custom endpoint baseURL: http://localhost:51737/p/openai/v1
  • Caveat: Provider files are enabled by default; any other storage category needs an explicit provider_storage.<prefix>: true opt-in, and request scanning still applies.

Internal OpenAI SDK application

  • Category: SDK
  • What’s protected: Outbound requests and supported request-contained files/images (requests only; responses are relayed)
  • Setup: Set base_url=“http://localhost:51737/p/openai/v1” in the OpenAI client and keep using your own provider key — the mesh relays it to the pinned provider.
  • Config: OpenAI client base_url="http://localhost:51737/p/openai/v1"
  • Caveat: Only traffic sent through this SDK client is covered; a hard-coded provider URL bypasses the mesh entirely.

Provider file upload/download API

  • Category: SDK
  • What’s protected: Upload requests and recognized provider-bound JSON references to file IDs minted through the same mesh alias; provider responses and downloaded bytes are not content-inspected
  • Setup: Call the provider Files API through the mesh base URL. A successful upload must be fully enumerable and return exactly one bounded file object before its ID is approved.
  • Config: provider_storage.files: true (the shipped default); set it to false to refuse the category.
  • Caveat: Duplicate-key, compressed, oversized, ambiguous, or unrecordable upload metadata returns an audited 502. Direct file list/retrieve/download/delete routes do not consume an attestation. The provider may already have received the upload, but the mesh will not trust its ID for recognized request-body reuse.

Internal Anthropic SDK application

  • Category: SDK
  • What’s protected: Outbound messages and supported content parts (requests only; responses are relayed)
  • Setup: Set the Anthropic client base_url=“http://localhost:51737/p/anthropic” and keep using your own provider credential — the mesh relays it to the pinned provider.
  • Config: Anthropic client base_url="http://localhost:51737/p/anthropic"
  • Caveat: Only traffic routed through this SDK client is covered; a hard-coded provider URL bypasses the mesh entirely.

LangChain, LlamaIndex, or other agent framework

  • Category: agent-framework
  • What’s protected: The outbound model leg and supported attachments when configured through the mesh (requests only; responses are relayed)
  • Setup: Point the framework’s LLM/provider base URL at the mesh (openai_api_base/base_url = http://localhost:51737/p/openai/v1, or the Anthropic equivalent) with your provider key.
  • Config: LLM base_url/openai_api_base = http://localhost:51737/p/openai/v1
  • Caveat: Direct tool, database, browser, MCP, and vector-store calls need their own controls; only the model leg is inspected.

RAG application

  • Category: SDK
  • What’s protected: Prompt, retrieved text, and supported documents included in the model request (requests only; the model’s answer is relayed back uninspected)
  • Setup: Route the generation call’s SDK client through the mesh base URL (base_url=http://localhost:51737/p/openai/v1 or http://localhost:51737/p/anthropic) with your provider key.
  • Config: SDK client base_url = http://localhost:51737/p/openai/v1
  • Caveat: Provider files are enabled with revision-bound ID reuse. Batches, fine-tuning, and vector stores default off; opting in vector stores accepts provider-held content the mesh cannot enumerate.

Slack/Teams custom bot

  • Category: bot
  • What’s protected: Outbound AI calls made by operator-owned bot code (requests only; responses are relayed)
  • Setup: Point the bot backend SDK at the mesh (base_url = http://localhost:51737/p/openai/v1 or http://localhost:51737/p/anthropic) with your provider key.
  • Config: bot backend SDK base_url = http://localhost:51737/p/openai/v1
  • Caveat: Native Slack/Teams or third-party app AI traffic is not automatically covered — only your operator-owned bot code’s model calls.

CI/CD review, test, or release bot

  • Category: bot
  • What’s protected: Outbound model calls and the source/context sent to the model (requests only; responses are relayed)
  • Setup: Point the CI job’s SDK client at the mesh (base_url = http://localhost:51737/p/openai/v1) and run it in a network-isolated job that can reach the mesh but not provider APIs directly.
  • Config: CI job SDK base_url = http://localhost:51737/p/openai/v1 (egress-restricted runner)
  • Caveat: The job must be network-isolated; if the runner can reach provider APIs directly it can bypass the mesh.

Internal support or sales copilot

  • Category: web-app
  • What’s protected: Outbound AI requests and supported files when the application is operator-owned (requests only; responses are relayed)
  • Setup: Point the backend SDK at the mesh (base_url = http://localhost:51737/p/openai/v1) with your provider key and keep the UI/backend on a mesh-only provider network path.
  • Config: backend SDK base_url = http://localhost:51737/p/openai/v1
  • Caveat: Coverage only holds when the application is operator-owned and its backend network path is mesh-only.

Image generation/editing API

  • Category: SDK
  • What’s protected: Prompt and supported input images on the request leg (requests only; generated images are relayed back uninspected)
  • Setup: Route image API calls through the mesh (base_url = http://localhost:51737/p/openai/v1) with your provider key.
  • Config: image API base_url = http://localhost:51737/p/openai/v1
  • Caveat: The request representation and every input image must be fully enumerable; unsupported, encrypted, oversized, or unscannable media blocks fail-closed.

Jupyter notebook or personal script

  • Category: SDK
  • What’s protected: Outbound SDK/API requests configured to use the mesh (requests only; responses are relayed)
  • Setup: Set the SDK client base URL/env in the notebook or script: OPENAI_BASE_URL=http://localhost:51737/p/openai/v1 or ANTHROPIC_BASE_URL=http://localhost:51737/p/anthropic, with your provider key.
  • Config: OPENAI_BASE_URL=http://localhost:51737/p/openai/v1 (or ANTHROPIC_BASE_URL=http://localhost:51737/p/anthropic)
  • Caveat: Process-local provider keys or hard-coded provider URLs can bypass the mesh unless egress is restricted.

Conditional

Gemini CLI

  • Category: CLI
  • What’s protected: Outbound model requests, only when the client is run in a supported OpenAI-/Anthropic-compatible mode (responses are relayed)
  • Setup: No Gemini adapter ships. Manually enable a configurable OpenAI-/Anthropic-compatible mode and point it at the mesh (OPENAI_BASE_URL=http://localhost:51737/p/openai/v1 or ANTHROPIC_BASE_URL=http://localhost:51737/p/anthropic) with your provider key.
  • Config: OPENAI_BASE_URL=http://localhost:51737/p/openai/v1 (compatible mode)
  • Caveat: Native raw Gemini protocol passthrough is not a supported route; only compatible-mode requests are inspected. Local tools stay outside the gateway.

AGY or another agent CLI

  • Category: CLI
  • What’s protected: Outbound model requests exposed through a supported custom base URL (responses are relayed)
  • Setup: Confirm the exact client/version supports a custom endpoint, then set that endpoint to the mesh (OPENAI_BASE_URL=http://localhost:51737/p/openai/v1 or the Anthropic equivalent) with your provider key.
  • Config: OPENAI_BASE_URL=http://localhost:51737/p/openai/v1 (if a custom endpoint is supported)
  • Caveat: No dedicated AGY adapter ships; coverage depends entirely on the client exposing a custom base URL. Agent tool/shell/MCP actions are separate.

Roo Code

  • Category: IDE-extension
  • What’s protected: Outbound model calls in a compatible/BYOK configuration (responses are relayed)
  • Setup: Requires an exposed custom endpoint: set the provider base URL to http://localhost:51737/p/openai/v1 with your provider key.
  • Config: OpenAI-compatible Base URL = http://localhost:51737/p/openai/v1 (custom endpoint required)
  • Caveat: Extension tools (terminal, browser, MCP, file ops) remain outside the gateway.

GitHub Copilot CLI

  • Category: CLI
  • What’s protected: Only outbound calls made through a BYOK/custom-endpoint mode, if one is available (responses are relayed)
  • Setup: If a BYOK/custom-endpoint mode exists, point it at the mesh (http://localhost:51737/p/openai/v1). Native Copilot service traffic is not transparently redirected, so block it at egress if policy requires mesh-only AI.
  • Config: BYOK/custom endpoint = http://localhost:51737/p/openai/v1 (if available); otherwise block at egress
  • Caveat: Native Copilot service traffic cannot be transparently redirected; enforcing mesh-only requires an egress block.

GitHub Copilot in VS Code

  • Category: IDE-extension
  • What’s protected: Outbound BYOK/custom-model requests routed to the mesh (responses are relayed)
  • Setup: Configure Copilot’s BYOK/custom model to use the mesh base URL (http://localhost:51737/p/openai/v1) with your own provider key.
  • Config: BYOK custom model Base URL = http://localhost:51737/p/openai/v1
  • Caveat: Copilot core/vendor-managed traffic is outside the mesh and is not inspected.

Cursor

  • Category: desktop-app
  • What’s protected: Outbound BYOK/custom-endpoint model requests (responses are relayed)
  • Setup: Enable Cursor’s Override OpenAI Base URL and set it to http://localhost:51737/p/openai/v1 with your own provider key.
  • Config: Cursor "Override OpenAI Base URL" = http://localhost:51737/p/openai/v1
  • Caveat: Client coverage remains incomplete: indexing and tab completion use Cursor’s own backend. Block native vendor traffic by egress policy if mesh-only AI is required.

Third-party SaaS with embedded AI

  • Category: SaaS
  • What’s protected: Outbound requests only, and only if the SaaS exposes a compatible customer endpoint/BYOK route (responses are relayed)
  • Setup: If the SaaS exposes a compatible customer endpoint/BYOK route, point it at the mesh (http://localhost:51737/p/openai/v1); otherwise use the vendor’s own controls or block the service at egress (blocked-alternative fallback).
  • Config: BYOK/customer endpoint = http://localhost:51737/p/openai/v1 if exposed; else "" (block at egress)
  • Caveat: Skilak Mesh cannot inspect traffic inside another vendor’s cloud; without a BYOK/customer endpoint the only options are vendor controls or an egress block.

Partial (model leg only)

MCP-enabled agent

  • Category: agent-framework
  • What’s protected: The outbound model request leg only (responses are relayed)
  • Setup: Route the agent’s model client through the mesh (base_url = http://localhost:51737/p/openai/v1 or the Anthropic equivalent) with your provider key; ensure MCP tool results re-enter a scanned model request.
  • Config: model client base_url = http://localhost:51737/p/openai/v1 (direct MCP egress remains outside)
  • Caveat: MCP server traffic and tool results are protected only when they re-enter a scanned model request; direct MCP egress is a separate boundary and is not inspected.

Audit-only

Ollama or another local OpenAI-compatible LLM

  • Category: local-LLM
  • What’s protected: Outbound requests routed through the mesh for consistent policy/audit (responses are relayed)
  • Setup: Optionally point the Ollama/local OpenAI-compatible client at the mesh (OPENAI_BASE_URL=http://localhost:51737/p/openai/v1) to get consistent policy/audit coverage.
  • Config: OPENAI_BASE_URL=http://localhost:51737/p/openai/v1 (optional, audit-only)
  • Caveat: Direct local inference has no cloud egress and is not intercepted automatically; routing is optional and audit-only in value.

Block & route

Windsurf

  • Category: desktop-app
  • What’s protected: None — the app has no supported rerouting seam
  • Setup: Block vendor AI traffic at egress (firewall/SWG/MDM) and provide an approved CLI or local web UI (Open WebUI/LibreChat) routed through the mesh instead.
  • Config: (none)
  • Caveat: No supported rerouting seam exists; the native app cannot be redirected, so protection comes only from the approved routed alternative.

JetBrains AI Assistant

  • Category: IDE-extension
  • What’s protected: None for vendor-managed traffic without a custom endpoint
  • Setup: Use an approved routed plugin/client, or block the native JetBrains AI service at egress.
  • Config: (none)
  • Caveat: Vendor-managed traffic exposes no custom endpoint to redirect into the mesh.

ChatGPT Desktop or chatgpt.com

  • Category: web-app
  • What’s protected: None for first-party consumer traffic
  • Setup: Do not TLS-intercept or DNS-redirect it into the mesh. Block it at egress and offer an approved routed UI (Open WebUI/LibreChat) instead.
  • Config: (none)
  • Caveat: First-party consumer traffic cannot be safely intercepted; TLS pinning, OAuth, and request signing make redirection unreliable and unsafe.

Claude Desktop or claude.ai

  • Category: web-app
  • What’s protected: None for first-party consumer traffic
  • Setup: Block when necessary and route users to Claude Code CLI or an approved routed UI through the mesh.
  • Config: (none)
  • Caveat: First-party consumer traffic cannot be safely intercepted; do not DNS-redirect or TLS-intercept it.

Gemini Desktop or gemini.google.com

  • Category: web-app
  • What’s protected: None for first-party consumer traffic
  • Setup: Block when necessary and route users to a supported CLI/UI path through the mesh.
  • Config: (none)
  • Caveat: First-party consumer traffic cannot be safely intercepted.

Microsoft 365 Copilot

  • Category: SaaS
  • What’s protected: None for Microsoft-managed service calls
  • Setup: Control it with Microsoft/MDM/SSE policy; Skilak Mesh is not an inline proxy for this product.
  • Config: (none)
  • Caveat: Microsoft-managed service calls cannot be proxied inline by the mesh; enforcement relies on Microsoft-native controls.

Source file: docs/SETUP-PER-CLIENT.md in SkilakLabs/mesh.