DEV Community

אייל מוזס
אייל מוזס

Posted on

Welcoming the Nepalese Government to Have I Been Pwned

Build the agent workflow once. Keep model-access controls separate so adding identity or a stop control doesn’t mean redesigning your product.

If you’re shipping a product that calls models, the first successful request is only the beginning. The execution loop still needs building—and teams burn afternoons rebuilding the same plumbing instead of the feature users need.

Start With a Local Agent Harness

Kimss Forge is Kimss AI’s MIT open-source agent harness. It runs locally, is free, and needs no Kimss account: start with a few lines and your model endpoint.

pip install kimss-forge
Enter fullscreen mode Exit fullscreen mode

That gives you a starting point for the agent loop without requiring a control-plane integration on day one. You bring the model endpoint; Kimss does not host models or resell compute.

Forge also emits a soft Authority Boundary warning when a sensitive tool fires without a production gateway. That warning never blocks local execution, and it is not paid Authority Boundary enforcement.

Attach Controls Without Replacing the Agent

When you need governed model access, add gateway="kimss" to the same Forge agent.

The gateway path adds identity on model calls and Kill Switch access on Developer, free. The important architectural separation is between what the agent does and how its model access is controlled.

Keep these responsibilities distinct:

  • Gateway identity identifies the caller.
  • Kill Switch severs access at the Kimss gateway for routed traffic.
  • Paid Authority Boundary is a separate capability—not another name for identity or Kill Switch.

The stop control is not a remote process killer. It cannot terminate a local process that never calls the gateway, and it does not stop model calls that bypass it.

Already Have a Model Client? Change the Route

You do not have to replace an existing agent to route its model calls through the control plane. Kimss provides an OpenAI-compatible inbound API at https://api.kimss.ai.

For an existing compatible client, the routing change is its base_url option:

base_url="https://api.kimss.ai"
Enter fullscreen mode Exit fullscreen mode

This shows the endpoint change, not a complete authenticated client configuration. Configure gateway access and your connected model infrastructure separately.

Bring your own agents and infrastructure. The gateway governs routed requests; it is not a chat app or a replacement model provider.

Keep the Upgrade Path Separate From the Workflow

Start local, attach the gateway when needed, and add paid controls later. Authority Boundary, SSO, and SCIM are later upgrades on the same path—not free Developer features and not a reason to rewrite the agent.

The Forge app-code comparison in BENCHMARK.md reports about 80% less app code than the hard way. Read that as an implementation comparison, not a promise about model quality, latency, or compute cost.

The practical lesson is simpler than the feature list: decide how you will identify callers and stop model access before other people depend on the integration.

Try the Local Path First

Run pip install kimss-forge and build against your model endpoint. The public starting point is Kimss Forge.

If you ship with models, put a control plane in front of them—start with Forge.

Top comments (0)