AtlasBurn Edge Proxy

What it is

A stateless Cloudflare Worker deployed at the edge. It transparently forwards your AI requests to the upstream provider while reading kill flags from a global GUARDRAIL_FLAGS KV namespace on every request. If your organization, or the feature a request belongs to, has tripped a guardrail, the proxy returns a 403 immediately, at the edge, before the provider is ever called.

Benefits over the SDK

• Zero code changes — swap one base URL. No npm install, no monkey-patching.
• Language-agnostic — works for Python, Go, Rust, Ruby, .NET, n8n, Zapier, LangChain, anything that speaks HTTP.
• Native SSE streaming — streams pass through unmodified with token usage extracted from the final frame.
• Server-side enforcement — guardrails are enforced before the request leaves your edge, not after the bill arrives.
• Fails open (Law 4) — if AtlasBurn is unreachable, the proxy still forwards the request. Never crash the proxy.

Setup

The hosted proxy at proxy.atlasburn.com works out of the box — no deployment required. For self-hosting (e.g. compliance, custom regions), deploy the worker yourself:

1. Initialize — from the atlasburn-proxy folder, run npx wrangler deploy.
2. Create the KV namespace — npx wrangler kv namespace create GUARDRAIL_FLAGS.
3. Bind the namespace — paste the returned id into wrangler.toml under [[kv_namespaces]] with the binding name GUARDRAIL_FLAGS, then redeploy.

name = "atlasburn-edge-proxy"
main = "src/index.ts"
compatibility_date = "2026-01-01"

[[kv_namespaces]]
binding = "GUARDRAIL_FLAGS"
id = "<your-kv-namespace-id>"

[vars]
ATLASBURN_INGEST_URL = "https://api.atlasburn.com/api/ingest"

# 1. Initial deploy
npx wrangler deploy

# 2. Create the KV namespace
npx wrangler kv namespace create GUARDRAIL_FLAGS

# 3. Paste the returned id into wrangler.toml under [[kv_namespaces]]

# 4. Redeploy with the binding active
npx wrangler deploy

Routing client traffic through the proxy

Swap the base URL on your existing AI client and append the AtlasBurn-API-Key header. Pick your setup — the provider's SDK, a raw HTTP call in any language, a framework, or a no-code tool. No SDK install required for the HTTP and no-code paths.

curl https://proxy.atlasburn.com/openai/v1/chat/completions \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -H "AtlasBurn-API-Key: $ATLASBURN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "model": "gpt-4o-mini",
  "messages": [
    {
      "role": "user",
      "content": "Hello from AtlasBurn"
    }
  ]
}'

Tagging features

Add an x-atlasburn-feature header to say which product feature a call belongs to. AtlasBurn breaks cost down by feature, and if one feature loops, only that feature is blocked while the rest of your traffic keeps flowing (see What gets blocked). The proxy strips the header before forwarding, so the provider never sees it.

curl https://proxy.atlasburn.com/openai/v1/chat/completions \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -H "AtlasBurn-API-Key: $ATLASBURN_KEY" \
  -H "x-atlasburn-feature: support-chat" \
  -H "Content-Type: application/json" \
  -d '{"model": "gpt-4o-mini", "messages": [{"role": "user", "content": "Hi"}]}'

Most provider SDKs accept extra headers per request or per client, for example default_headers in the OpenAI Python client. Untagged calls are grouped per provider (proxy-openai, proxy-anthropic, …).

Supported Providers

• OpenAI — https://proxy.atlasburn.com/openai/v1
• Anthropic — https://proxy.atlasburn.com/anthropic/v1
• Google Gemini — https://proxy.atlasburn.com/gemini/v1beta
• OpenRouter — https://proxy.atlasburn.com/openrouter/v1
• Cohere — https://proxy.atlasburn.com/cohere/v1
• Mistral — https://proxy.atlasburn.com/mistral/v1
• Groq — https://proxy.atlasburn.com/groq/openai/v1
• Together AI — https://proxy.atlasburn.com/together/v1
• DeepSeek — https://proxy.atlasburn.com/deepseek/v1
• xAI (Grok) — https://proxy.atlasburn.com/xai/v1

Next Steps

• Autonomous Runtime Guardrails — the 5-layer defense engine
• Proxy Gateway examples — Python, Go, Rust, LangChain, n8n
• SDK Integration — when to use the JS SDK instead