Build the agent workflow once. Keep model-access controls separate so adding identity or a stop control doesn’t mean redesigning your product.
If you’re shipping a product that calls models, the first successful request is only the beginning. The execution loop still needs building—and teams burn afternoons rebuilding the same plumbing instead of the feature users need.
Start With a Local Agent Harness
Kimss Forge is Kimss AI’s MIT open-source agent harness. It runs locally, is free, and needs no Kimss account: start with a few lines and your model endpoint.
pip install kimss-forge
That gives you a starting point for the agent loop without requiring a control-plane integration on day one. You bring the model endpoint; Kimss does not host models or resell compute.
Forge also emits a soft Authority Boundary warning when a sensitive tool fires without a production gateway. That warning never blocks local execution, and it is not paid Authority Boundary enforcement.
Attach Controls Without Replacing the Agent
When you need governed model access, add gateway="kimss" to the same Forge agent.
The gateway path adds identity on model calls and Kill Switch access on Developer, free. The important architectural separation is between what the agent does and how its model access is controlled.
Keep these responsibilities distinct:
- Gateway identity identifies the caller.
- Kill Switch severs access at the Kimss gateway for routed traffic.
- Paid Authority Boundary is a separate capability—not another name for identity or Kill Switch.
The stop control is not a remote process killer. It cannot terminate a local process that never calls the gateway, and it does not stop model calls that bypass it.
Already Have a Model Client? Change the Route
You do not have to replace an existing agent to route its model calls through the control plane. Kimss provides an OpenAI-compatible inbound API at https://api.kimss.ai.
For an existing compatible client, the routing change is its base_url option:
base_url="https://api.kimss.ai"
This shows the endpoint change, not a complete authenticated client configuration. Configure gateway access and your connected model infrastructure separately.
Bring your own agents and infrastructure. The gateway governs routed requests; it is not a chat app or a replacement model provider.
Keep the Upgrade Path Separate From the Workflow
Start local, attach the gateway when needed, and add paid controls later. Authority Boundary, SSO, and SCIM are later upgrades on the same path—not free Developer features and not a reason to rewrite the agent.
The Forge app-code comparison in BENCHMARK.md reports about 80% less app code than the hard way. Read that as an implementation comparison, not a promise about model quality, latency, or compute cost.
The practical lesson is simpler than the feature list: decide how you will identify callers and stop model access before other people depend on the integration.
Try the Local Path First
Run pip install kimss-forge and build against your model endpoint. The public starting point is Kimss Forge.
If you ship with models, put a control plane in front of them—start with Forge.
Top comments (0)