Your APIs, your MCP tools, and every model your teams call, behind one binary you run yourself. In your VPC or air-gapped, with no vendor control plane in the path.
REST call, tool invocation, or completion, SBproxy terminates the TLS, checks the caller, applies the policy, then routes it. One policy graph and one audit log for all three kinds of traffic, so there is no second tool where the rules can drift.
See how routing works →Most teams end up with a proxy for the APIs, a second thing for MCP, and a third for the model calls. Three configs, three sets of credentials, three places the policy can be wrong. These are the same problem wearing different protocols.
Put an existing HTTP service behind policy without adding a hop, because SBproxy is the proxy. TLS it issues itself from ACME, a CRS-derived baseline WAF, fifteen auth providers from API keys through JWT to full OIDC, load balancing with health checks, transforms, and caching.
Federate internal MCP servers behind one endpoint with OAuth2, DPoP, and PKCE. Scope which tools each agent can see, meter every call into a session ledger, and re-export an OpenAPI spec you already have as MCP tools without writing a server.
Two hundred models across 70 providers on one OpenAI-compatible endpoint, on your keys at your prices. Or point a serve: block at your own GPU and SBproxy fits an engine to the card and governs it with the same keys, budgets, and guardrails.
Keep the SDK you already use. Point its base_url at SBproxy and call any model by name, across 70 providers or your own GPUs. The request shape never changes, and your provider keys stay on your side.
client = OpenAI(
# your SBproxy, in your VPC
base_url="https://sbproxy.acme.internal/v1",
api_key=os.environ["SB_KEY"],
)
# any of 200+ models, by name
client.chat.completions.create(
model="claude-sonnet-4-5",
messages=[...],
)
# provider down? SBproxy fails over.Model routing, failover, budgets, caching, guardrails, MCP exposure, and crawler policy declare in the same YAML. Versioned in git, reviewed like code, hot-reloaded on save.
# the ai you call action: type: ai_proxy providers: - name: anthropic api_key: ${ANTHROPIC_API_KEY} - name: local-vllm base_url: http://gpu-01:8000/v1 routing: strategy: fallback_chain guardrails: input: - type: pii - type: injection budget: limits: - scope: workspace max_cost_usd: 150 period: daily
# the ai that calls you action: type: mcp federated_servers: - type: openapi origin: https://api.acme.com spec_path: openapi.yml oauth: authorization_servers: - https://auth.acme.com policies: - type: ai_crawl_control price: 0.001 currency: USD - type: rate_limit requests_per_minute: 600
Turn on the admin block in sb.yml and keys, spend, provider health, and live traffic are already wired. The console is a URL on the gateway itself, so there is nothing extra to deploy or buy.
One static Rust binary. Homebrew, Docker, or a straight download.
$ brew install soapbucket/tap/sbproxyProviders, routing, budgets, and guardrails in one file you review like code.
$ sbproxy --config sb.ymlChange the base URL. Every model in the catalog answers on one endpoint.
base_url="https://sbproxy.internal/v1"