Sentinel CLI proxy

Instead of managing environment variables manually across different terminals, the Sentinel CLI can manage system-wide proxy states natively.

1. Configure your providers and gateway URL

Tell the CLI which providers you want to intercept and where your gateway is located:

sentinel proxy config providers
sentinel proxy config url

sentinel proxy config providers accepts any of openai, anthropic, and google (space-separated), or all to select every supported provider.

(This updates your local configuration under ~/.config/sentinel/config.json)

2. Toggle the proxy globally

Once configured, you can turn the interception environment rules on or off across your entire session layout:

# Inject the environment variables globally across your session environment
sentinel proxy on

# Remove the environment variables and restore default direct-to-cloud routing
sentinel proxy off

When the proxy is on, the CLI writes the provider base-URL variables (OPENAI_BASE_URL, ANTHROPIC_BASE_URL, GOOGLE_GEMINI_BASE_URL) pointing at your configured gateway. sentinel proxy off removes them and restores direct-to-cloud routing.

Auto-configure apps like Codex and Claude Desktop

Some tools — such as the Codex CLI and the Claude desktop app — don't read the provider base-URL environment variables, so the proxy toggle above can't reach them. For these, the CLI updates the app's own config to point it at your gateway.

Choose which supported apps to auto-configure:

sentinel proxy config apps

Enter the apps space-separated, all for every supported app, or none to disable it and manage them yourself. Codex and Claude Desktop are supported today and included by default — more apps are coming soon.

• Codex — with it enabled, sentinel proxy on writes ~/.codex/config.toml so the Codex CLI routes through your gateway. This needs the OpenAI provider in your configuration.
• Claude Desktop (macOS and Linux) — with it enabled, sentinel proxy on points the Claude desktop app at your gateway. This needs the Anthropic provider in your configuration, and the CLI will prompt you once to sign in to your Claude account in the browser so it can store a token for the proxy. Restart Claude Desktop afterwards to apply.

sentinel proxy off reverts every app it configured.

3. Verify your policy

Send a test payload through the gateway to confirm your guardrails are working — no provider key required, and nothing is recorded in telemetry:

sentinel test --text "My email is [email protected] and my key is sk-proj-abc123"

The CLI prints whether the prompt passed, was redacted, or was blocked, along with the redacted text.

Get Sentinel: Create a free SUPERWISE® account.

See also

• Install on macOS and Linux (CLI): install the CLI and run the quickstart.
• Environment-variable instrumentation: set the variables by hand.
• Gateway reference: the full list of CLI commands.