Per-agent users
Don’t share theadmin user with agents. Add a per-agent user with a method whitelist:
rpcauth= and rpcwhitelist= line to proxy.conf. Full method list and semantics: API auth.
Session policies
Always close sessions explicitly when work is done. Unused stake returns in the close txn; the used stipend day-locks in
userStakesOnHold until the next UTC day (claim via withdrawUserStakes). Plan agent float for gross daily stake — used MOR is not reusable the same UTC day. See Sessions: stake, close, claim.
Streaming vs non-streaming
Agents that need full deterministic JSON should usestream: false. Tool-calling chains that benefit from token streaming (e.g. user-facing typing UX) should set stream: true. The proxy-router supports both transparently — see Chat.
Rate limiting
The proxy-router does not currently expose per-user rate limits. If you need hard limits, terminate agent traffic at a reverse proxy (nginxlimit_req, Caddy rate limiter, etc.) in front of :8082.
Observability
- Tag each agent with its own
User-Agentheader for log filtering. - Run a small log shipper to capture
./data/proxy-router.loglines. - Use
GET /v1/models/attestationif your agents targettee-tagged models — surface attestation state in your dashboards.
Failure recovery
For a more concrete worked example, see Gateway for Everclaw.