Question 1

What is an AI Governance Gateway?

Accepted Answer

An AI Governance Gateway is a single runtime that decides who reaches your APIs and content, what they can do, what it costs, and what they pay. It covers inbound monetization, agent identity, content negotiation for agents, and outbound LLM and MCP traffic from one policy graph and one audit log. SBproxy is an AI Governance Gateway that runs inside your VPC.

Question 2

What is SBproxy?

Accepted Answer

SBproxy is the AI Governance Gateway. One self-hostable gateway for AI traffic, API requests, MCP tools, and AI crawlers. It handles inbound monetization (Pay Per Crawl, x402, Stripe MPP, virtual keys), agent identity (Web Bot Auth via RFC 9421), content for agents (HTML to Markdown, RSL, llms.txt), and outbound AI governance (200+ models, MCP federation, budgets, guardrails). Distributed under BSL 1.1.

Question 3

How is SBproxy different from Cloudflare Pay Per Crawl?

Accepted Answer

Cloudflare runs at its own edge. SBproxy runs in your VPC, region, Kubernetes cluster, or air-gapped environment. Pricing is tier-aware, per route, per shape, and per agent rather than domain-wide. Inbound monetization, agent identity, content negotiation, and outbound AI governance live on one policy graph instead of separate Cloudflare products. Settlement supports both x402 and Stripe MPP, and you can act as your own Merchant of Record.

Question 4

How is SBproxy different from Helicone, LiteLLM, or Kong AI Gateway?

Accepted Answer

Helicone, LiteLLM, and Kong are point gateways. They cover one slice. SBproxy covers all five slices of the AI Governance Gateway: inbound monetization, agent identity, content for agents, outbound AI governance, and in-VPC deployment. Same policy graph, same audit log, same runtime. Helicone is excellent for LLM observability. LiteLLM is a Python library, not a gateway. Kong is a traditional API gateway with AI bolt-ons. SBproxy is the gateway that does the full job.

Question 5

Where does SBproxy deploy?

Accepted Answer

Single binary on a server, Kubernetes operator on a fleet, or air-gapped install on a regulated network. Same policy graph in every shape. No phone-home. No SaaS edge. Bring your own Stripe, your own SSO, your own observability, and your own audit sink. Suitable for EU, India, Saudi Arabia, US public sector, defense, healthcare, and finance workloads with sovereignty requirements.

Question 6

Is SBproxy open source?

Accepted Answer

SBproxy is source-available under the Business Source License 1.1 (BSL 1.1). Production use is permitted for everything except offering SBproxy as a competing hosted or managed service. The license converts to Apache 2.0 on 2030-05-01. Read every line on GitHub. Verify every binary.

Question 7

What is Pay Per Crawl and how does SBproxy support it?

Accepted Answer

Pay Per Crawl is the pattern of charging AI crawlers for access to content using HTTP 402 Payment Required. SBproxy ships the ai_crawl_control policy: AI crawlers that arrive without a valid payment token receive a 402 response with a JSON challenge. The crawler retries with the issued token and the proxy validates it through a pluggable ledger. Settlement supports x402 stablecoin and Stripe MPP. Tokens can be priced per route, per shape, and per agent.

Question 8

What is Web Bot Auth and how does SBproxy verify AI agents?

Accepted Answer

Web Bot Auth is the IETF pattern for verifying signed AI crawlers and agents. SBproxy implements it through the bot_auth provider. Agents sign each request with an Ed25519 key under RFC 9421 HTTP Message Signatures and advertise their key id in the Signature-Input header. The gateway looks up the matching public key in its directory and verifies the signature. Agents that pass come through. Everything else gets 401.

Question 9

Does SBproxy support MCP?

Accepted Answer

Yes. SBproxy ships an MCP gateway that federates internal tools under one identity model. Authentication supports OAuth2 with DPoP, PKCE, and DCR. Federated servers can be wrapped from any OpenAPI service, with per-server prefix and RBAC. The same policy graph that governs API and AI traffic also governs MCP tool invocations.

Question 10

What does SBproxy replace?

Accepted Answer

A traditional API gateway (Kong, nginx, Envoy), an AI gateway or LLM router (Helicone, LiteLLM, Portkey), a guardrails service, a bot management product, and a payment rail for crawlers (TollBit, Skyfire). One runtime instead of five vendors stitched together. One policy graph instead of five control planes. One audit log instead of five disconnected feeds.

Question 11

How many AI providers does SBproxy support?

Accepted Answer

SBproxy reaches 200+ models behind one OpenAI-compatible API, including OpenAI, Anthropic, Google Gemini, AWS Bedrock, Azure OpenAI, Groq, Mistral, Cohere, Together AI, Fireworks, xAI Grok, OpenRouter, Cerebras, NVIDIA NIM, Databricks, IBM watsonx, Oracle GenAI, plus self-hosted runtimes like vLLM, Ollama, and TGI. Routing supports fallback chains, weighted, round-robin, latency-based, and cost-optimized strategies.

Question 12

Is SBproxy safe to run in front of production traffic?

Accepted Answer

SBproxy ships as a single static binary. Releases are cut from tagged commits in a public repository on GitHub. Dependencies are pinned and checksummed. The runtime does not fetch code from a public package registry when it starts. The deployment shape matches nginx, HAProxy, and Envoy. Hot reload is supported without dropping connections.

The AI Governance Gateway.

The AI Governance
Gateway.