Integrate Shadow: proxy, gateway, Docker, Kubernetes or Rust

Shadow integrates in four ways: as a local HTTPS proxy for every AI API client on a machine, as a gateway base URL for SDKs, as a Docker or Kubernetes sidecar, or in-process as the shadow-core Rust library. Pick the integration that matches how your traffic reaches the model. Most desktop tools use proxy mode; SDKs and servers usually use the gateway base URL.

• Integration modesChoose how to run Shadow: an HTTPS proxy for every AI tool on a machine, a gateway base URL for SDKs, or the embedded Rust library, and when to use each.
• Proxy modeRun Shadow as an HTTPS proxy that masks PII in the AI API traffic of every tool on a machine: local CA trust, intercepted hosts, bypass rules and PAC.
• Gateway modeMask PII in OpenAI, Anthropic, OpenRouter and Gemini calls by pointing your SDK's base URL at Shadow. Examples in Python, Node.js and curl. No CA needed.
• Embed in RustEmbed the shadow-core Rust crate to mask and restore LLM calls in-process: sessions, intent policy, JSON and streaming helpers, no proxy hop.
• Docker and KubernetesRun Shadow as a sidecar container in Docker or Kubernetes to mask PII in your service's LLM calls, with persistent state and controlled egress.
• Integrating any endpointPut Shadow in front of anything that calls an LLM: Claude Code and coding assistants, IDEs, agents, desktop apps, custom APIs and self-hosted gateways.

Frequently asked questions

Which integration mode should I use?

Use the gateway when a tool lets you set a base URL, the proxy to cover every AI API client on a machine, and the shadow-core library when you build the service in Rust. See integration modes.

Do I have to change my code?

Usually not. Most tools need one environment variable, such as OPENAI_BASE_URL=http://127.0.0.1:8877/gw/openai/v1 or HTTPS_PROXY=http://127.0.0.1:8877.

Can Shadow run on servers and in Kubernetes?

Yes. Run it as a systemd service on a VM, or as a sidecar container next to your app on localhost:8877 in gateway mode.