Question 1

Is SBproxy a reverse proxy or an AI gateway?

Accepted Answer

Both. SBproxy is a reverse proxy that doubles as an AI gateway. It terminates TLS and handles HTTP/1.1, HTTP/2, WebSocket, and gRPC like nginx or Envoy, and it also routes LLM traffic across 200+ models with guardrails, budgets, and MCP federation. One Rust binary, one YAML config. The AI features were added to a runtime that was already a production-grade proxy, not a Python SDK that grew a server.

Question 2

What is SBproxy?

Accepted Answer

SBproxy is a reverse proxy that doubles as an AI gateway. One self-hostable runtime for AI traffic, API requests, MCP tools, and AI crawlers. It routes 200+ models with guardrails, budgets, and MCP federation, runs every API gateway feature (auth, WAF, rate limiting, transforms, caching), and adds inbound controls like Pay Per Crawl and Web Bot Auth. Single static Rust binary, distributed under the Apache License 2.0.

Question 3

How is SBproxy different from Cloudflare Pay Per Crawl?

Accepted Answer

Cloudflare runs at its own edge. SBproxy runs in your VPC, region, Kubernetes cluster, or air-gapped environment. Pricing is tier-aware, per route, per shape, and per agent rather than domain-wide. Inbound monetization, agent identity, content negotiation, and outbound AI governance live on one policy graph instead of separate Cloudflare products. Settlement supports both x402 and Stripe MPP, and you can act as your own Merchant of Record.

Question 4

How is SBproxy different from Helicone, LiteLLM, or Kong AI Gateway?

Accepted Answer

Helicone, LiteLLM, and Kong each cover one slice. SBproxy covers the whole traffic layer from one runtime: a real reverse proxy, an AI gateway across 200+ models, every API gateway feature, plus inbound controls like Pay Per Crawl and Web Bot Auth. Same config, same audit log, same binary. Helicone is excellent for LLM observability. LiteLLM is a Python library, not a proxy. Kong is a traditional API gateway with AI bolt-ons. SBproxy does the full job in one Rust binary.

Question 5

Where does SBproxy deploy?

Accepted Answer

Single binary on a server, Kubernetes operator on a fleet, or air-gapped install on a regulated network. Same policy graph in every shape. No phone-home. No SaaS edge. Bring your own Stripe, your own SSO, your own observability, and your own audit sink. Suitable for EU, India, Saudi Arabia, US public sector, defense, healthcare, and finance workloads with sovereignty requirements.

Question 6

Is SBproxy open source?

Accepted Answer

SBproxy is open source under the Apache License 2.0. Free for any use, including production and commercial, with no field-of-use restriction. Read every line on GitHub. Verify every binary.

Question 7

What is Pay Per Crawl and how does SBproxy support it?

Accepted Answer

Pay Per Crawl is the pattern of charging AI crawlers for access to content using HTTP 402 Payment Required. SBproxy ships the ai_crawl_control policy: AI crawlers that arrive without a valid payment token receive a 402 response with a JSON challenge. The crawler retries with the issued token and the proxy validates it through a pluggable ledger. Settlement supports x402 stablecoin and Stripe MPP. Tokens can be priced per route, per shape, and per agent.

Question 8

What is Web Bot Auth and how does SBproxy verify AI agents?

Accepted Answer

Web Bot Auth is the IETF pattern for verifying signed AI crawlers and agents. SBproxy implements it through the bot_auth provider. Agents sign each request with an Ed25519 key under RFC 9421 HTTP Message Signatures and advertise their key id in the Signature-Input header. The gateway looks up the matching public key in its directory and verifies the signature. Agents that pass come through. Everything else gets 401.

Question 9

Does SBproxy support MCP?

Accepted Answer

Yes. SBproxy ships an MCP gateway that federates internal tools under one identity model. Authentication supports OAuth2 with DPoP, PKCE, and DCR. Federated servers can be wrapped from any OpenAPI service, with per-server prefix and RBAC. The same policy graph that governs API and AI traffic also governs MCP tool invocations.

Question 10

What does SBproxy replace?

Accepted Answer

A traditional API gateway (Kong, nginx, Envoy), an AI gateway or LLM router (Helicone, LiteLLM, Portkey), a guardrails service, a bot management product, and a payment rail for crawlers (TollBit, Skyfire). One runtime instead of five vendors stitched together. One policy graph instead of five control planes. One audit log instead of five disconnected feeds.

Question 11

How many AI providers does SBproxy support?

Accepted Answer

SBproxy reaches 200+ models behind one OpenAI-compatible API, including OpenAI, Anthropic, Google Gemini, AWS Bedrock, Azure OpenAI, Groq, Mistral, Cohere, Together AI, Fireworks, xAI Grok, OpenRouter, Cerebras, NVIDIA NIM, Databricks, IBM watsonx, Oracle GenAI, plus self-hosted runtimes like vLLM, Ollama, and TGI. Routing supports fallback chains, weighted, round-robin, latency-based, and cost-optimized strategies.

Question 12

Is SBproxy safe to run in front of production traffic?

Accepted Answer

SBproxy ships as a single static Rust binary. Releases are cut from tagged commits in a public repository on GitHub. Dependencies are pinned and checksummed in Cargo.lock. The runtime does not fetch code from a public package registry when it starts. The deployment shape matches nginx, HAProxy, and Envoy. Hot reload is supported without dropping connections.

Govern every API, every agent, every model.

Govern every API,
every agent, every model.