Getting Started Open-Core

Go from zero to your first blocked tool call in under 5 minutes.

┌──────────────┐    ┌──────────────┐    ┌──────────────────┐
│  Your IDE /  │───▶│ Intutic      │───▶│  LLM Provider    │
│  AI Agent    │◀───│ Proxy :4000  │◀───│  (OpenAI, etc.)  │
└──────┬───────┘    └──────┬───────┘    └──────────────────┘
       │ each              │
       │ tool call  ┌──────▼──────────────────────┐
┌──────▼───────┐    │ Policy: SOP front matter,   │
│  Hook gate   │    │ WASM rules, DLP, detectors  │
│  (Step 3)    │    └─────────────────────────────┘
└──────────────┘
  (all local; a decide engine, if you add one,
   is your own model on this machine or your network)

Everything above runs on your machine. A control plane is optional and not part of open core; see Security for what changes if you connect one.

Every LLM request from your AI agent flows through Intutic's local proxy, where SOPs (Standard Operating Procedures) evaluate each tool call in real time and return a verdict: BYPASS, HIJACK, REASK or KILL from the proxy, or ENHANCE from a control plane's evaluator.

Prerequisites

Requirement	Version
Node.js	20.19 or later
npm	10 or later
AI coding agent	Any of the 43 supported harnesses (Cursor, Claude Code, Aider, Windsurf, Antigravity, etc.)
Valkey (or Redis)	Optional. 8.x — a shared, durable cache. intutic start provisions one if it can, and runs without it if it cannot

That is the whole list. Valkey is not required, and neither is a configuration file — the proxy runs on built-in defaults.

intutic start will try to give you a Valkey anyway, because it is worth having: it makes the response cache shared across processes and lets a control plane attach later. But if Docker is unavailable or the machine is locked down, the proxy simply runs standalone. Bandit learning still persists, to ~/.intutic/bandit-state.json.

With or without Valkey, a proxy with no control plane accepts the same keys: your provider key, which it forwards, or an Intutic virtual key, for which it uses the provider key in its own environment.

Already have a Valkey elsewhere? Point at it with VALKEY_URL=redis://host:port.

Step 1 — Install the CLI & Native Proxy Gateway

# Install global CLI and native Rust proxy binary
npm install -g @intutic/cli @intutic/proxy

# Or run the native proxy directly on-demand
npx @intutic/proxy

Verify:

intutic --version

It prints the installed version number.

Alternative package managers & Standalone Binaries

# pnpm
pnpm add -g @intutic/cli @intutic/proxy

# yarn
yarn global add @intutic/cli @intutic/proxy

For environments without Node.js, download single-file precompiled binaries directly from GitHub Releases:

• 🪟 Windows (x64): cli-win-x64.exe / intutic-proxy-win32-x64.exe
• 🐧 Linux (x64): cli-linux-x64 / intutic-proxy-linux-x64
• 🐧 Linux (arm64): intutic-proxy-linux-arm64 (proxy only)
• 🍎 macOS (Apple Silicon): cli-macos-arm64 / intutic-proxy-darwin-arm64
• 💻 macOS (Intel): cli-macos-x64 / intutic-proxy-darwin-x64

Step 2 — Initialize your workspace

From your project root (must contain a .git/ directory or package.json):

intutic init

This auto-detects every AI harness in your project and records them in ~/.intutic/config.json. It makes no network call and writes no harness files; intutic gates install (Step 3) writes those. At a terminal, init offers to run it for you; --gates or --no-gates answers that in a script.

Intutic — Workspace Initialization
✔ Workspace root: /home/dev/my-project
ℹ Detecting AI harnesses...

  ✔ cursor → /home/dev/my-project/.cursor/rules/intutic-governance.mdc
  ✔ claude-code → /home/dev/my-project/.claude/rules/intutic-governance.md
  ○ antigravity (not detected)
  ○ windsurf (not detected)
  ...

✔ Detected 2 harnesses

Install Intutic Git hooks (post-commit, post-checkout, pre-commit secret scan, post-merge)? [Y/n]:
✔ Workspace initialized.

The Git hooks question is only asked at a terminal. In CI or a script, pass --git-hooks or --no-git-hooks; with neither, init skips the hooks.

Local development

Record dev mode, so later commands use a local control plane (http://localhost:3001):

intutic init --dev

Step 3 — Install the gates

intutic gates install

For each harness init recorded, this writes its blocking gate and, when .intutic/sops/ holds rule sets, its rules file. Everything comes from local files; no control plane or account is involved. --dry-run shows what it would write, and --harness <id> limits it to one harness. Each harness's page under Integrations lists the files, and intutic disconnect takes them out again.

The gates enforce the built-in protections, your rule sets and their front matter on every tool call. A review_before: hold needs a reviewer, which only a control plane provides, so without one the gates refuse those calls.

Step 4 — Start the proxy

Standalone (open core)

One command. No account, no configuration file, nothing leaving your machine:

intutic start

ℹ No Valkey detected on port 6379. Trying to start one…
ℹ Docker detected — starting a Valkey container (intutic-valkey)…
✔ Valkey running in Docker (intutic-valkey) on port 6379.
ℹ Starting proxy on port 4000…
INFO intutic_proxy: Listening on 127.0.0.1:4000

If no Valkey can be started — no Docker, no valkey-server on your PATH — the proxy runs anyway:

ℹ No Valkey detected on port 6379. Trying to start one…
⚠ Could not start Valkey — running standalone.
ℹ Routing, policies, DLP and local spend caps all work.
ℹ Bandit learning persists to ~/.intutic; the response cache is per-process.
ℹ
ℹ To get a shared, durable cache later:
ℹ Intutic needs a Valkey (or Redis) on port 6379.
…
ℹ Starting proxy on port 4000 (standalone)…
INFO intutic_proxy: Listening on 127.0.0.1:4000

DLP scanning, WASM rule enforcement, policy evaluation and intelligent routing all run locally either way. What Valkey adds is a response cache shared between processes, and the ability for a control plane to attach.

What standalone gives up

Nothing that requires a control plane was ever available in open core, so standalone loses only:

• A shared response cache. Each proxy process caches for itself.
• Cross-process bandit state. Learning still persists across restarts via ~/.intutic/bandit-state.json, but two proxies on one machine learn separately rather than pooling.

Provider credentials are held in memory only and never written to disk in either mode.

Running the proxy yourself

intutic start is a convenience wrapper. To manage Valkey yourself, run the proxy directly — it needs no configuration file:

intutic-proxy

Force standalone even when a Valkey is running:

INTUTIC_STANDALONE=1 intutic-proxy

Route your agent

Set your agent's base URL environment variable to point at the local Intutic proxy:

# Host only — the Anthropic SDK and Claude Code append /v1/messages themselves.
# Adding /v1 here produces /v1/v1/messages, which the proxy cannot route.
export ANTHROPIC_BASE_URL="http://localhost:4000"

For a harness with a config key for its base URL, such as Codex or Aider, intutic gates install --route writes it for you while the proxy runs; or start the agent with intutic exec -- <agent>, which sets these variables for that process.

intutic start also keeps the installed gates current: when a rule set under .intutic/sops/ changes, it rewrites them (intutic start --no-gates leaves them alone).

Now, every LLM API call and tool execution is evaluated pre-flight.

---

Step 5 — Trigger your first block

Open your AI agent and ask it to do something destructive:

"Delete all files in /tmp"

The proxy reads the tool call, and a shell or code-execution call carrying a destructive operation (rm -rf /, mkfs, dd if=, …) is a KILL: the request is refused with HTTP 403 and code policy_denied.

Request blocked by anomaly policy [TOOL_ABUSE]: Code-execution call 'Bash'
contains a destructive operation ('rm -rf /'). Per-call gates cannot see
inside a code blob; this one was read.

The proxy alone reads a call's arguments once the call comes back in the conversation history, on the next request. To refuse a tool before the harness runs it, name it in an SOP's deny_tools, which the proxy applies to the model's response, or rely on the pre-tool-use gate intutic gates install installs.

Step 6 — View your trace

Check the trace from the command line:

intutic traces list --limit 5

With no control plane connected, this reads the proxy's own trace log (~/.intutic/logs/traces-*.jsonl) and shows each trace's local verdict (allowed, killed, reasked, hijacked or upstream_error); connected, it shows the control plane's enforcement action and compliance score instead.

Intutic — Execution Traces (local)
  No control plane connected — reading directly from ~/.intutic/logs/. No compliance score locally.
┌────────────────┬─────────────────────┬──────────────────┬────────────────┬───────────┐
│ Trace ID       │ Timestamp           │ Model            │ Verdict        │ Cost      │
├────────────────┼─────────────────────┼──────────────────┼────────────────┼───────────┤
│ 3f2a9c1e-7b... │ 2026-07-04 07:30:01 │ claude-sonnet-4… │ killed         │ $0.0000   │
│ 9d41b0a2-5c... │ 2026-07-04 07:28:44 │ claude-sonnet-4… │ allowed        │ $0.0123   │
└────────────────┴─────────────────────┴──────────────────┴────────────────┴───────────┘
Showing 2 of 2 traces (last 24 hours)

Drill into the blocked trace. The table shortens trace IDs; inspect takes the full one, which intutic traces list --json prints:

intutic traces inspect 3f2a9c1e-7b4d-4e8a-9c21-5d6f7a8b9c0d

Or check your full system status in another terminal:

intutic status

Intutic — Workspace Status
  Email: you@company.com
  Workspace: wk_k8x9m2p4
  Control Plane: https://your-control-plane.example
  Workspace Root: /home/dev/my-project
  Dev Mode: no
  Config Version: 14

ℹ Detected harnesses:
  ✔ cursor
  ✔ claude-code
  Last Sync: 2026-07-04T07:30:13.000Z
  Tracked Files: 2

ℹ Active Running Processes:
  (none detected)

  Sync Daemon State: Running

Disconnecting

intutic disconnect undoes intutic gates install: every harness config it changed goes back the way it was. Run it with --dry-run first to see each change, and --harness <id> to disconnect one harness. See intutic disconnect for what it restores and what it leaves.

intutic disconnect --dry-run
intutic disconnect

What's next?

Topic	Description
How It Works	Understand the proxy → policy engine → verdict pipeline
Enforcement Actions	Deep dive into BYPASS, ENHANCE, HIJACK, REASK and KILL
Custom Filters (WASM)	Create WASM policy rules for custom tool-call filtering
Integrations	Detailed setup guides for all 43 harnesses
CLI Reference	Complete command reference for @intutic/cli