Overview

AegisGate Rampart is a free, open-source local proxy that sits between AI coding tools (GitHub Copilot, Cursor, local LLMs) and the AI models they communicate with. It inspects every prompt you send and every response you receive, scanning in real time for leaked secrets, personally identifiable information (PII), prompt-injection attacks, hallucinated code, and toxic content.

Who is Rampart for?

• Individual developers who use Copilot, Cursor, or local LLMs and want to prevent accidental secret leakage.
• Teams that need a lightweight, local-first security layer before adopting a centralized platform.
• Security-conscious organizations that require air-gapped, on-device detection with no network egress.
• Privacy advocates who want full transparency — Rampart is Apache 2.0 and ships with zero external dependencies for core functionality.

Installation

Rampart ships as a single static binary with no runtime dependencies. Pre-built release assets are cosign-signed and available for all major platforms.

Binary Releases

13 release assets are published for every version:

Download from the releases page, verify the cosign signature, and place the binary on your PATH:

# macOS / Linux
chmod +x rampart
sudo mv rampart /usr/local/bin/

# Verify installation
rampart version
rampart verify

Docker

docker pull ghcr.io/aegisgatesecurity/aegisgate-rampart:v0.7.1

# Run in proxy mode on port 8080
docker run -d \
  --name rampart \
  -p 8080:8080 \
  -v rampart-config:/config \
  ghcr.io/aegisgatesecurity/aegisgate-rampart:v0.7.1 \
  --port=8080 --config=/config --mode=block

IDE Plugins

Rampart integrates directly into popular editors via the Language Server Protocol (LSP):

Note: IDE plugin mode provides real-time inline warnings as you type, before the prompt is even sent. Proxy mode scans traffic after it leaves the editor. Using both together gives you defense-in-depth.

Quick Start

Option A: Local Proxy Mode (5 minutes)

1. Install the CA certificate so Rampart can intercept HTTPS traffic:

rampart --trust

2. Start the proxy in block mode:

rampart --port=8080 --mode=block -v

3. Point your AI tool at the proxy. Set the proxy as your HTTP/HTTPS proxy:

export HTTP_PROXY=http://localhost:8080
export HTTPS_PROXY=http://localhost:8080

Or configure your IDE’s proxy settings to http://localhost:8080.

4. Use your AI tool normally. Rampart inspects every request and response transparently. Detected threats are logged (monitor mode) or blocked (block mode).

Option B: IDE Plugin Mode (3 minutes)

1. Install the Rampart extension/plugin for your editor (see IDE Plugins).
2. Open a file and start typing a prompt to your AI assistant.
3. Inline diagnostics appear in real time — no proxy configuration needed.
4. Configure blocking behavior in your editor settings or via the Rampart config file.

Option C: Daemon Mode (background)

# Start as a background daemon with system tray
rampart --daemon

# Check status
rampart --status

# Stop / remove auto-start
rampart --no-autostart

Configuration

Rampart can be configured via CLI flags, configuration files, and environment variables. CLI flags take precedence over config files, which take precedence over environment variables.

CLI Flags

CLI Subcommands

Webhook subcommand usage

# Add a Slack webhook
rampart webhook add \
  -name "slack-alerts" \
  -url "https://hooks.slack.com/services/YOUR_TEAM/YOUR_CHANNEL/YOUR_WEBHOOK_TOKEN" \
  -secret "my-hmac-secret" \
  -skip-tls-verify=false \
  -timeout 30s

# List all webhooks
rampart webhook list

# Test a webhook
rampart webhook test -name "slack-alerts"

# Enable / disable
rampart webhook enable -name "slack-alerts"
rampart webhook disable -name "slack-alerts"

# Remove
rampart webhook remove -name "slack-alerts"

Configuration File

Rampart looks for a configuration file in the directory specified by --config (default: ~/.rampart/). The main configuration file is config.yaml:

# ~/.rampart/config.yaml

mode: block                    # monitor | block
port: 8080                     # local proxy port
rate_limit: 0                  # requests/second (0 = unlimited)

# CA certificate encryption
ca_key_passphrase: ""          # passphrase for CA private key encryption

# Audit log encryption
audit_key_passphrase: ""       # passphrase for audit log encryption
audit_log_path: ~/.rampart/audit

# Privacy-preserving metrics (opt-in)
anonymized_metrics: false
metrics_endpoint: ""

# Platform integration (optional)
platform:
  url: ""
  api_key: ""

# Detection settings
detection:
  enable_l1_regex: true        # 38 L1 regex patterns
  enable_l2_compliance: true   # 35 L2 compliance patterns
  enable_ml_evasion: true      # 15 ML evasion resistance patterns
  enable_ml_model: true        # Char CNN-BiLSTM with Attention
  enable_response_scan: true   # Scan AI responses
  enable_pii_scan: true
  enable_secret_scan: true
  enable_hallucination_scan: true
  enable_toxicity_scan: true

# Webhooks
webhooks:
  - name: "slack-alerts"
    url: "https://hooks.slack.com/services/..."
    enabled: true
    method: POST
    secret: "my-hmac-secret"
    skip_tls_verify: false
    timeout: 30s
    headers:
      Content-Type: "application/json"

# LLM provider presets (override defaults)
llm_presets:
  ollama:
    url: "http://localhost:11434/v1"
  lm_studio:
    url: "http://localhost:1234/v1"

Verify your configuration at any time:

rampart config check
rampart config verify
rampart config hash

Environment Variables

All CLI flags can also be set via environment variables using the RAMPART_ prefix. Dashes become underscores:

export RAMPART_MODE=block
export RAMPART_PORT=8080
export RAMPART_CA_KEY_PASSPHRASE="my-secure-passphrase"
rampart

Operating Modes

Rampart supports three deployment modes and two enforcement modes. These are orthogonal — you choose a deployment mode (how Rampart runs) and an enforcement mode (what it does with detections).

Deployment Modes

1. IDE Plugin Mode (LSP Server)

Runs inside your editor as a Language Server Protocol server. Provides real-time inline diagnostics as you type — before the prompt is even sent to the model.

• Best for: Individual developers who want immediate feedback
• Setup: Install the editor extension/plugin (no proxy config needed)
• Coverage: Scans prompts in the editor; does not intercept network traffic

# The LSP server is launched automatically by the editor plugin.
# You can also launch it manually for debugging:
rampart --lsp

2. Local Proxy Mode (MITM)

Runs as a transparent HTTPS proxy on localhost. Intercepts all AI-related HTTP traffic, regardless of which tool generated it.

• Best for: Comprehensive coverage across all AI tools on your machine
• Setup: Install CA cert (--trust), configure proxy settings
• Coverage: Scans both prompts (requests) and responses

rampart --port=8080 --mode=block --trust -v

3. Daemon Mode

Runs as a background process with system tray notifications. Combines proxy functionality with desktop alerts.

• Best for: Always-on protection without a terminal window
• Setup: rampart --daemon (optionally with --autostart)

# Start daemon with auto-start on boot
rampart --daemon --autostart --mode=block

# Check status
rampart --status

# Remove auto-start and stop
rampart --no-autostart

Enforcement Modes

# Monitor mode — log only, no blocking
rampart --mode=monitor

# Block mode — actively block threats
rampart --mode=block

# Equivalent shorthand
rampart --block

Tip: Start in monitor mode to understand what Rampart detects in your workflow, then switch to block mode once you’re confident in the detection results.

Detection Capabilities

Rampart uses a multi-layered detection pipeline combining regex patterns, compliance rule sets, ML evasion resistance, and a deep learning model — all running locally with ~5 ms latency.

Layer 1: Regex Patterns (38 patterns)

Layer 2: Compliance Patterns (35 patterns)

Rampart maps detections to major compliance frameworks, making it easy to demonstrate regulatory adherence:

Layer 3: ML Evasion Resistance (15 patterns)

Detects attempts to bypass regex-based detection using common obfuscation techniques:

Layer 4: ML Model (Char CNN-BiLSTM with Attention)

Rampart includes a character-level CNN-BiLSTM neural network with attention mechanism — the same architecture used in AegisGate Platform, reimplemented in pure Go for on-device inference.

• Architecture: Char CNN → BiLSTM → Attention → Dense
• Inference: Pure Go, no external ML runtime required
• Latency: Sub-millisecond inference, ~5 ms total pipeline
• Purpose: Catches novel prompt injection and obfuscated secrets that regex misses

Response Scanning

Rampart doesn’t just scan what you send — it also scans what comes back:

# Enable response scanning (enabled by default)
rampart --mode=block -v
# Response scanning can be toggled in config.yaml:
# detection:
#   enable_response_scan: true

Webhook Integration

Rampart can forward audit events to webhook endpoints, enabling real-time alerts in Slack, Discord, Microsoft Teams, or any custom HTTP endpoint.

Configuration

Webhooks are configured via CLI subcommands or directly in config.yaml:

webhooks:
  # Slack
  - name: "slack-alerts"
    url: "https://hooks.slack.com/services/YOUR_TEAM/YOUR_CHANNEL/YOUR_WEBHOOK_TOKEN"
    enabled: true
    method: POST
    secret: "my-hmac-signing-secret"
    skip_tls_verify: false
    timeout: 30s
    headers:
      Content-Type: "application/json"

  # Discord
  - name: "discord-alerts"
    url: "https://discord.com/api/webhooks/YOUR_WEBHOOK_ID/YOUR_WEBHOOK_TOKEN"
    enabled: true
    method: POST
    secret: ""
    skip_tls_verify: false
    timeout: 30s
    headers:
      Content-Type: "application/json"

  # Microsoft Teams
  - name: "teams-alerts"
    url: "https://outlook.office.com/webhook/..."
    enabled: true
    method: POST
    secret: "teams-signing-secret"
    skip_tls_verify: false
    timeout: 30s

  # Custom endpoint
  - name: "siem-forwarder"
    url: "https://siem.internal.company.com/api/rampart-events"
    enabled: true
    method: POST
    secret: "siem-hmac-secret"
    skip_tls_verify: true
    timeout: 10s
    headers:
      Content-Type: "application/json"
      Authorization: "Bearer internal-token"

WebhookConfig Fields

Event Payload

Each audit event is delivered as a JSON payload:

{
  "timestamp": "2026-09-09T16:59:00Z",
  "event_type": "secret_detected",
  "host": "developer-laptop-01",
  "blocked": true,
  "category": "secrets",
  "severity": "critical",
  "pattern": "aws_access_key_id",
  "redacted_content": "AKIA****XXXX"
}

HMAC Verification

Webhook payloads are signed with HMAC-SHA256 using the configured Secret. The signature is sent in the X-Rampart-Signature header:

# Example: verifying the signature in Python
import hmac
import hashlib

def verify_signature(payload: bytes, secret: str, signature: str) -> bool:
    expected = hmac.new(
        secret.encode(),
        payload,
        hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature)

// Example: verifying the signature in Node.js
const crypto = require('crypto');

function verifySignature(payload, secret, signature) {
    const expected = crypto
        .createHmac('sha256', secret)
        .update(payload)
        .digest('hex');
    return crypto.timingSafeEqual(
        Buffer.from(expected),
        Buffer.from(signature)
    );
}

Managing Webhooks via CLI

# Add
rampart webhook add \
  -name "slack-alerts" \
  -url "https://hooks.slack.com/services/..." \
  -secret "my-hmac-secret" \
  -skip-tls-verify=false \
  -timeout 30s

# List
rampart webhook list

# Test delivery
rampart webhook test -name "slack-alerts"

# Enable / disable
rampart webhook enable -name "slack-alerts"
rampart webhook disable -name "slack-alerts"

# Remove
rampart webhook remove -name "slack-alerts"

Platform Integration

Rampart operates fully standalone in air-gap mode. Connecting to AegisGate Platform is optional and enables centralized policy management, aggregated audit, and compliance reporting.

Connecting to Platform

rampart --platform-url="https://platform.aegisgate.io" \
        --platform-api-key="ak_live_XXXXXXXXXXXXXX" \
        --mode=block

Or via environment variables:

export RAMPART_PLATFORM_URL="https://platform.aegisgate.io"
export RAMPART_PLATFORM_API_KEY="ak_live_XXXXXXXXXXXXXX"
rampart

What Platform Integration Provides

Air-Gap Mode

When --platform-url is not set (the default), Rampart operates in full air-gap mode:

• No network egress whatsoever
• All detection, logging, and alerting happens locally
• No data leaves your machine
• No account or registration required

Privacy guarantee: Disconnecting from Platform at any time instantly reverts to full air-gap mode. No data is retained on Platform after disconnection.

LLM Provider Presets

Rampart ships with built-in presets for popular local LLM inference servers. These presets auto-configure the correct API endpoint format for each provider.

Listing Presets

rampart llm list

Available LLM presets:
  ollama                 http://localhost:11434/v1
  lm_studio              http://localhost:1234/v1
  localai                http://localhost:8080/v1
  vllm                   http://localhost:8000/v1
  text_generation_webui  http://localhost:5000/v1

Overriding Preset URLs

Override any preset URL in your config file:

llm_presets:
  ollama:
    url: "http://192.168.1.100:11434/v1"
  vllm:
    url: "http://gpu-server.local:8000/v1"

Using Rampart with Local LLMs

When using local LLMs through Rampart, configure your AI tool to point at Rampart’s proxy instead of the LLM server directly. Rampart will forward traffic to the correct preset endpoint:

# Start Rampart in proxy mode
rampart --port=8080 --mode=block -v

# Point your tool at Rampart instead of Ollama directly
# Before:  http://localhost:11434/v1/chat/completions
# After:   http://localhost:8080/v1/chat/completions

Privacy & Security

Rampart is built on 12 non-negotiable privacy principles. These are architectural guarantees, not configurable options.

The 12 Privacy Guarantees

CA Certificate Security

Rampart generates a local CA certificate for MITM interception. This CA is:

• Generated locally on your machine
• Encrypted at rest with your passphrase
• Never transmitted anywhere
• Removable via rampart --no-autostart and manual cert cleanup

# Install CA cert into system trust store
rampart --trust

# Encrypt the CA private key at rest
rampart --trust --ca-key-passphrase="my-secure-passphrase"

Anonymized Metrics (Opt-In)

When explicitly enabled, Rampart sends only aggregate, non-identifiable counters:

rampart --anonymized-metrics --metrics-endpoint="https://metrics.aegisgate.io/v1/rampart"

What is sent:

• Total request count (per hour)
• Detection category counts (e.g. “5 secrets, 2 PII”)
• No prompts, no responses, no patterns, no IPs, no hostnames

What is never sent:

• Prompt or response content (even redacted)
• Pattern names or matched text
• Hostnames, IP addresses, or user identifiers
• Configuration details

Audit Logs

Rampart maintains a local audit log of all detection events. Audit logs are encrypted at rest and contain redacted content only — no raw secrets or PII are ever stored.

Enabling Audit Log Encryption

# Set a passphrase for audit log encryption
rampart --audit-key-passphrase="my-audit-passphrase" --mode=block

Or in config:

audit_key_passphrase: "my-audit-passphrase"
audit_log_path: ~/.rampart/audit

Audit Log Format

Each audit entry contains:

{
  "timestamp": "2026-09-09T16:59:00.123Z",
  "event_type": "secret_detected",
  "host": "dev-laptop-01",
  "blocked": true,
  "category": "secrets",
  "severity": "critical",
  "pattern": "aws_access_key_id",
  "redacted_content": "AKIA****XXXX",
  "source": "proxy",
  "destination": "api.openai.com"
}

Note: The redacted_content field always shows redacted excerpts. Raw secrets, full PII, and complete prompt/response text are never written to disk.

Decrypting Audit Logs

To read encrypted audit logs, use the decrypt-audit subcommand:

rampart decrypt-audit \
  --audit-key-passphrase="my-audit-passphrase" \
  ~/.rampart/audit/2026-09-09.log.enc

To decrypt and pipe to a file:

rampart decrypt-audit \
  --audit-key-passphrase="my-audit-passphrase" \
  ~/.rampart/audit/2026-09-09.log.enc > audit-2026-09-09.json

Audit Log Rotation

Audit logs are written daily and rotated automatically. Old logs remain encrypted and can be decrypted at any time with the original passphrase.

Warning: If you lose your audit passphrase, encrypted audit logs cannot be recovered. Store your passphrase securely.

Troubleshooting

Common Issues

Rampart is not intercepting traffic

Symptom: No detections appear in logs despite using AI tools.

Solutions:

1. Verify the CA certificate is installed:

   rampart --trust
   rampart verify
   

2. Verify proxy settings are correct:

   echo $HTTPS_PROXY
   # Should show: http://localhost:8080
   

3. Run in verbose mode to see intercepted traffic:

   rampart --port=8080 -v
   

4. Some tools bypass system proxy settings. Check your IDE’s proxy configuration directly.

CA certificate errors

Symptom: x509: certificate signed by unknown authority

Solutions:

# Re-install the CA certificate
rampart --trust

# On macOS, you may need to manually trust the cert in Keychain Access
# On Linux, copy the cert to /usr/local/share/ca-certificates/ and run update-ca-certificates
# On Windows, use certmgr to import the Rampart CA

“Port already in use”

Symptom: bind: address already in use

Solutions:

# Use a different port
rampart --port=8081

# Or find and stop the process using port 8080
lsof -i :8080    # macOS/Linux
netstat -ano | findstr :8080  # Windows

High CPU usage

Symptom: Rampart consuming excessive CPU.

Solutions:

1. Enable rate limiting:

   rampart --rate-limit=100
   

2. Disable ML model if not needed (falls back to regex + compliance only):

   detection:
     enable_ml_model: false
   

3. Check for pprof data:

   rampart --pprof=localhost:6060
   # Then visit http://localhost:6060/debug/pprof/
   

Webhook delivery failures

Symptom: Webhook test fails or events not arriving.

Solutions:

# Test the webhook
rampart webhook test -name "slack-alerts"

# Check if webhook is enabled
rampart webhook list

# For self-signed certs on the receiving end
rampart webhook add -name "custom" -url "https://internal.example.com/hook" \
  -skip-tls-verify=true -timeout 60s

Audit log decryption fails

Symptom: decrypt-audit returns errors.

Solutions:

1. Verify you’re using the correct passphrase:

   rampart decrypt-audit --audit-key-passphrase="correct-passphrase" file.log.enc
   

2. Check if the log file is corrupted:

   rampart verify
   

3. If the passphrase is lost, the logs cannot be recovered. This is by design — encryption is meant to protect the logs.

Debug Mode

For detailed debugging, use verbose output and the pprof server:

rampart --mode=monitor -v --pprof=localhost:6060

Verifying Installation Integrity

rampart verify

This checks:

• Binary integrity (checksums)
• CA certificate presence and validity
• Configuration file validity
• Required permissions

Getting Help

• GitHub Issues: github.com/AegisGateSecurity/rampart/issues
• Documentation: docs.aegisgate.io
• Community: community.aegisgate.io

FAQ

Is Rampart really free?

Yes. Rampart is 100% free and open source under the Apache 2.0 license. There is no freemium model, no telemetry, and no vendor lock-in. The optional AegisGate Platform integration is a separate paid product, but Rampart itself is and will always be free.

Does Rampart send my data anywhere?

No. By default, Rampart operates in air-gap mode with zero network egress. All detection happens locally on your machine. The only outbound connections are to the AI provider you’re proxying to (which is the whole point — that traffic would happen anyway). Anonymized metrics are opt-in and contain only aggregate counts, never content.

Can I use Rampart without any AI coding tools?

Yes. Rampart’s scan command lets you scan any file directly:

rampart scan ./src/config.py
rampart scan ./.env
rampart scan ./docker-compose.yml

This is useful for CI/CD pipelines or pre-commit hooks.

How does Rampart compare to GitHub Advanced Security or other secret scanners?

Rampart is specifically designed for AI coding workflows. Traditional secret scanners examine files at rest; Rampart examines prompts and responses in flight. It detects:

• Secrets you’re about to paste into a prompt (before they reach the AI provider)
• PII that an AI model might leak in a response
• Prompt injection attacks embedded in code comments or documentation
• Hallucinated package names and APIs in AI-generated code

Traditional scanners and Rampart are complementary, not competitive.

Does Rampart slow down my AI tools?

No. Rampart adds approximately 5 ms of latency per request. At 235 requests per second throughput capacity, this is imperceptible in normal developer workflows. The ML model runs in pure Go with no external runtime, keeping memory and CPU overhead minimal.

Can I use Rampart in a corporate environment?

Yes. Rampart is designed for both individual and enterprise use. Key enterprise features:

• Air-gap mode for restricted networks
• CA key encryption at rest
• Audit log encryption at rest
• Configurable rate limiting
• Webhook integration with SIEM systems
• Optional Platform integration for centralized management
• Cosign-signed release binaries for supply chain security
• No external dependencies to audit

What AI providers does Rampart intercept?

Rampart intercepts all HTTP/HTTPS traffic through its proxy. It has been tested with 27 AI API endpoints including:

• OpenAI (ChatGPT API, Copilot)
• Anthropic (Claude)
• Google (Gemini, Codey)
• GitHub Copilot
• Cursor
• Ollama, LM Studio, vLLM, LocalAI, Text Generation WebUI (local LLMs)
• Azure OpenAI
• AWS Bedrock
• Cohere
• Mistral AI
• Together AI
• Anyscale
• Replicate

If your AI tool communicates over HTTP/HTTPS, Rampart can intercept it.

What happens when Rampart detects a threat in block mode?

In block mode, Rampart:

1. For requests: Prevents the prompt from reaching the AI provider. Returns a 403 response with a diagnostic message explaining what was detected.
2. For responses: Strips or replaces the offending content before it reaches your editor. The rest of the response is delivered normally.
3. In IDE plugin mode: Shows inline diagnostics and prevents the prompt from being sent.

The detection is always logged to the audit log (with redacted content), and forwarded to any configured webhooks.

Can I customize which detections block vs. monitor?

Yes. In your config file, you can set per-category enforcement:

detection:
  block_on:
    - secrets
    - pii
  monitor_on:
    - hallucination
    - toxicity

How do I update Rampart?

# Check current version
rampart version

# Download the new binary from releases, then:
rampart verify   # Verify integrity of the new binary

# Your existing config and CA certificates are preserved

For Docker:

docker pull ghcr.io/aegisgatesecurity/aegisgate-rampart:v0.7.2
docker stop rampart && docker rm rampart
docker run -d --name rampart -p 8080:8080 -v rampart-config:/config \
  ghcr.io/aegisgatesecurity/aegisgate-rampart:v0.7.2 --mode=block

Is Rampart FIPS compliant?

Rampart uses Go’s standard crypto library, which is FIPS-eligible. For strict FIPS 140-2 environments, use the Go FIPS-enabled build. Check the releases page for FIPS-compliant binaries.

Can I contribute to Rampart?

Yes! Rampart is open source and welcomes contributions. See the contributing guide for details on building from source, running tests, and submitting pull requests.

# Build from source
git clone https://github.com/AegisGateSecurity/rampart.git
cd rampart
go build -o rampart ./cmd/rampart

# Run tests
go test ./... -cover

With 1,318 test functions and 80.7% coverage, the test suite ensures reliability across all detection layers.