Bifrost acts as an enterprise AI gateway to route Claude Code to Amazon Bedrock, Google Vertex AI, and private models while ensuring secure LLM governance.
Engineering organizations deploying agentic command-line tools like Claude Code often face strict compliance hurdles regarding data egress, API key distribution, and uncapped cloud costs. Routing these terminal agents through an enterprise AI gateway resolves these security issues by centralizing credentials and enforcing granular access control. Bifrost, an open-source AI gateway written in Go, serves as a transparent proxy that maps Claude Code requests directly to AWS Bedrock, Google Vertex AI, or on-premise deployments. This setup allows teams to run secure, cloud-hosted models without altering the native developer experience.
Why Enterprises Route Claude Code Through an AI Gateway
An enterprise AI gateway is a centralized infrastructure layer that manages, secures, and proxies all API requests between client applications and large language model providers. For terminal agents like Claude Code, the gateway intercepts requests, manages authentication, and routes calls to corporate-approved endpoints like Amazon Bedrock or Google Vertex AI.
When developers run agentic tools directly against public APIs, organizations run into several operational and security bottlenecks:
- Credential Leakage: Distributing raw API keys to hundreds of developer machines introduces severe security exposure.
- Data Egress Boundaries: Corporate security policies often mandate that sensitive codebase data remain within virtual private clouds (VPCs) hosted on Amazon Bedrock or Google Cloud Vertex AI instead of being sent to third-party endpoints.
- Uncapped Consumption: Because autonomous agents execute multi-step loops to solve programming tasks, a single runaway agentic process can consume millions of tokens in minutes.
- Compliance Gaps: Industry standards such as SOC 2 and GDPR require immutable audit trails of all code and prompts processed by external models.
Using Bifrost as the gateway resolves these issues. By routing the Claude Code CLI agent through Bifrost, teams can enforce virtual keys with predefined budgets and keep sensitive data securely within corporate-approved environments.
Setting Up Claude Code with Amazon Bedrock and Vertex AI
To connect Claude Code to enterprise cloud models, platform engineers first configure the provider backends within the Bifrost control plane. Bifrost supports an array of supported providers, enabling seamless protocol translation.
The configuration YAML file defines the credentials and endpoints for Bedrock and Vertex AI:
providers:
bedrock:
aws_region: "us-east-1"
aws_access_key_id: "your-aws-access-key-id"
aws_secret_access_key: "your-aws-secret-access-key"
vertex:
google_project_id: "your-gcp-project-id"
google_region: "us-central1"
application_credentials_json: "your-gcp-creds-json"
Next, configure the routing rules in Bifrost. Because Claude Code hardcodes its model expectations to specific Anthropic model names, Bifrost uses dynamic aliasing. The names sonnet-model and haiku-model act as arbitrary labels that Claude Code sends, which Bifrost dynamically translates.
For instance, a routing rule in Bifrost can map the incoming model ID sonnet-model to vertex/claude-sonnet-4-6 or bedrock/claude-3-7-sonnet (utilizing the AWS Bedrock or Google Vertex AI backends).
Once the gateway is ready, developers update their local Claude Code configuration. The settings are located in the user's home directory under ~/.claude/settings.json. Merge the following parameters into the configuration file:
{
"env": {
"ANTHROPIC_BASE_URL": "https://bifrost.example.com/anthropic",
"ANTHROPIC_AUTH_TOKEN": "bifrost-virtual-key-here",
"ANTHROPIC_DEFAULT_SONNET_MODEL": "sonnet-model",
"ANTHROPIC_DEFAULT_HAIKU_MODEL": "haiku-model"
}
}
By defining these environment variables:
-
ANTHROPIC_BASE_URLroutes all inference traffic away from Anthropic's public servers and directs it to the gateway's/anthropicpath. -
ANTHROPIC_AUTH_TOKENholds the virtual key issued by the platform team. This token handles authentication directly at the gateway, eliminating the need to expose raw AWS or Google Cloud credentials on developer machines.
Centralized Cost Control and Multi-Region Load Balancing
Agentic workflows require highly reliable endpoints. If an AWS region experiences an outage or if a specific model endpoint encounters rate limits, developer velocity drops immediately.
With Bifrost, platform teams can apply central governance and security controls. Using budget and rate limits per virtual key, administrators can constrain maximum spend per developer or per project.
To maintain continuous uptime, Bifrost supports automatic fallbacks. If Amazon Bedrock in us-east-1 returns a rate limit (HTTP 429) or a temporary server failure, the request is automatically retried and routed to Google Vertex AI or to Bedrock in another region, such as us-west-2.
fallback_rules:
- conditions:
- status_code: 429
- status_code: 503
targets:
- provider: vertex
model: claude-3-7-sonnet
- provider: bedrock
region: us-west-2
model: claude-3-7-sonnet
Furthermore, adaptive load balancing automatically distributes requests across multiple API keys and endpoints based on real-time health checks and latency metrics. This ensures that developer terminals remain active, stable, and highly performant regardless of upstream cloud issues.
Endpoint Enforcement with Bifrost Edge
While manual configuration of local files like ~/.claude/settings.json is effective for testing, rollouts to thousands of engineers are prone to configuration drift. Developers can easily bypass the gateway, use unapproved local models, or accidentally commit API keys to public repositories.
To establish complete visibility and security, organizations utilize Bifrost Edge. Edge acts as the endpoint layer of the Bifrost platform. It runs as an agent on employee laptops across macOS, Windows, and Linux, extending the central gateway's rules directly to local machines.
Edge targets shadow AI by automatically intercepting and routing LLM traffic. When a developer starts Claude Code in their terminal, Edge detects the request and transparently routes it through the central gateway without requiring any changes to environment variables.
This provides several major advantages for platform teams:
- Zero-Config Developer Experience: Developers install Claude Code normally. They do not edit settings files, manage base URLs, or copy API keys.
- SSO-Based Identity: Edge links directly with the enterprise identity provider. When a developer logs in via single sign-on (SSO), Edge fetches their authorized virtual keys automatically.
- Fleet-Wide App Governance: Admins can enforce app governance policies. Approved tools like Claude Code run with full governance in the background, while unapproved developer tools are blocked before data leaves the machine.
- Automated MDM Deployment: IT teams can easily distribute Edge across the organization's entire machine fleet by deploying via MDM tools like Microsoft Intune, Jamf, Workspace ONE, or Kandji.
- Robust Endpoint Security: By enforcing endpoint security rules, Edge prevents leaks of passwords, API keys, or proprietary data directly on the developer's laptop, blocking the request before it reaches any external model.
Securing Agentic Workflows with MCP Tool Control
In addition to pure text generation, agentic terminals rely heavily on the Model Context Protocol tools to read directories, edit local files, execute terminal scripts, and pull web resources. Allowing an autonomous agent to execute tools on developer machines presents serious security concerns if the agent reads sensitive configuration files or runs malicious scripts.
By acting as an MCP gateway, Bifrost acts as a single integration hub for all MCP tools. This eliminates the need to configure multiple separate servers on individual developer machines.
Once connected, administrators can deploy granular filters:
- Tool Allowlists: Restrict specific terminal agents to only use read-only filesystem tools or approved web search tools.
- Per-User Tool Permissions: Bind specific MCP tool groups to virtual keys, granting tool execution privileges only to senior developers or specific teams.
- Central Audit Trails: Log every tool execution, parameters sent, and files modified, creating an audit-ready compliance ledger.
These restrictions are automatically pushed down to Bifrost Edge on the device, ensuring that MCP governance policies are strictly enforced locally. If Claude Code attempts to run an unapproved MCP tool configuration on a machine, Edge blocks the execution before any commands are run.
Streamlining Setup with the Bifrost CLI
For teams piloting Claude Code, the Bifrost CLI streamlines local setup. Developers can avoid manual environment variable modifications and launch their desired coding agent in a single command:
npx -y @maximhq/bifrost-cli
The CLI launches an interactive configuration flow in the terminal:
- Base URL: The developer enters the company's central Bifrost gateway URL.
- Virtual Key: The developer enters their virtual key (stored securely in the local OS keyring).
- Agent Selection: The developer selects Claude Code.
- Auto-Configuration: The CLI verifies model availability, configures local environment paths, and launches Claude Code inside a secure wrapper.
This workflow guarantees that even in non-Edge environments, developer configurations are uniform and correctly connected to the central routing rules, failovers, and auditing layers.
Getting Started with Secure Developer Agents
Deploying advanced coding agents does not require compromising on corporate compliance, data sovereignty, or cost tracking. By employing a centralized control plane, engineering organizations can deploy high-performance agents across their team safely.
Platform engineers looking to run secure agentic workflows can evaluate enterprise-grade features on the Bifrost Enterprise page or investigate the open-source repository on GitHub to get started.
Top comments (0)