An AI that writes your edge rules
Describe what you want in plain English and Iris drafts the rule — firewall, rate limit, traffic policy, routing, error page. Before any change it previews the real blast radius against your recent traffic; you approve, and every action is logged. Iris acts only within your own permissions.
- Confirms every change
- Acts under your role
- Fully audited
The same trustworthy loop, every time
By default Iris changes nothing without your approval. Every action follows the same closed loop.
Ask
Describe the rule you want in plain language — “block scanners on /admin”, “rate-limit login to 5 per minute per IP”.
Preview the blast radius
Before it writes a rule, Iris replays your recent real traffic through the proposed change and shows exactly what it would affect — how many requests newly blocked, how many were succeeding — with a safe / risky verdict.
Apply, verify, roll back
You approve; it applies within your permissions and logs it. Then it watches the real effect for a few minutes and reverts the change automatically if traffic regresses.
Just ask
Plain English in, a reviewable rule out.
“Block scanners hitting /admin”
Drafts a firewall rule with the right match and action for you to review.
“Rate-limit login to 5 per minute per IP”
Drafts a rate-limit rule scoped to the right endpoint, window, and scope.
“5xx on checkout slower than 800ms, last hour”
The smart-filter compiles your English into a real Traffic Inspector filter you can tweak and re-run.
“Why was this request blocked?”
Per-request explain: opens a captured request and says which rule matched and why.
Iris also answers questions about your account (“what endpoints do I have?”, “who are my members?”, “how close am I to my plan limit?”) by reading the live API rather than guessing, and searches your HTTP traffic logs from a plain-English query — it can even compile a structured, downloadable account report.
Opt in to hands-off firewall rules
Once you trust the loop, let Iris handle one narrow, reversible job on its own: firewall rules. It's opt-in, off by default, and never all-or-nothing — everything else still asks first.
Firewall rules only
Autonomy is scoped to firewall rules — blocking or unblocking traffic. Every other kind of write (rate limits, traffic policy, routing, deletes) always comes back to you for approval.
Only when it's safe
An automatic firewall change happens only if the traffic dry-run says it's safe. Anything risky, or anything Iris can't fully simulate, still comes to you.
Auto-reverts
Every automatic firewall change is verified against real traffic and reverted automatically if it regresses.
Draft a metric alert in plain English
Describe the condition you care about and Iris drafts a metric-alert rule — a threshold on a metric, over a window, for an endpoint — that you review and turn on. The alert fires when the condition is met; Iris drafts it, it doesn't self-heal.
“Alert me if p95 latency goes over 300 ms”
Drafts a latency-threshold alert on the endpoint for you to review and enable.
“Alert if my error rate crosses 1%”
Drafts an error-rate alert scoped to the endpoint and window you name.
“Warn me when I hit 80% of my data cap”
Drafts a usage-threshold alert so you get room to act, not a surprise.
“Tell me when blocked traffic spikes”
Drafts an alert on firewall-block volume for you to enable.
Two ways to use AI
A one-shot generator for drafting a single rule, and Iris — the chat agent — for multi-step work: editing rules, filtering traffic, explaining a request, and answering how-to questions.
AI Generate
- Firewall policies — even fuzzy intents like “block scanners”
- Traffic-policy rules — rate limit, redirect, custom response, headers, JWT
- Routing rules — picks the right agent from your connected fleet
- Rate-limit rules — conditions, scope, window, action
- Error-page templates — full HTML/CSS with error tokens
Iris
- Create, edit, disable, delete & reorder rules — “disable the jwt-verify rule”
- Smart-filter — compile plain English into a real Traffic Inspector filter, or search your traffic logs from a plain-English query
- Per-request explain — “why was this request blocked?” on a captured request
- Account Q&A — “what endpoints do I have?”, members & roles, plan entitlements & quotas, verification — read from the live API
- Compiles a structured, downloadable account report on request
- How-to answers from the docs & knowledge base, navigation, ticket creation
- Confirmation card + blast-radius dry-run before any write
Or bring your own AI assistant
Iris lives in the dashboard. The MCP server lets the AI you already work in — Claude Code, Claude Desktop, or any MCP client — drive your ngris account directly. It's live at mcp.ngris.com and exposes 150+ user-facing tools: near-full control of your account, from the assistant you already have open.
Connect in one command
- Add the server:
claude mcp add --transport http ngris https://mcp.ngris.com/mcp - Authenticate with OAuth 2.1 — a browser tab opens, you approve, nothing to copy or paste
- Or pass an ngris API key as a bearer token for scripts and other clients
- Works with any MCP client over Streamable HTTP, or stdio locally
Safe to hand to an agent
- User-facing scope only — no admin routes are reachable
- Every tool forwards your credential — it can never do more than you can
- Reads run freely; writes are confirmed before they run
- An OAuth/MCP session cannot mint long-lived credentials — create keys in the dashboard
What your assistant can do
The tools map onto the same surfaces you use in the dashboard — grouped by domain.
Endpoints
List, create, and delete endpoints; health checks; the auth gate (none / basic / token / OAuth / JWT, force-HTTPS); client access; mTLS; OAuth providers; cache stats & purge; TLS cert assignment.
Applications & hosting
Create and deploy — upload a zip, one-shot quick-deploy to a live URL, or git-deploy — redeploy, roll back, read build logs, set env vars, get preview URLs, and provision a managed database.
Domains · DNS · TLS
Add, check, and verify domains; list certificate status and reissue; and manage DNS records — end to end from chat.
Edge policy & security
Firewall policies, rate limits, routing rules, and traffic policies — with a blast-radius preview and CEL test-expression before apply — plus custom error pages.
Traffic inspection
Logs, metrics (requests, bandwidth, errors), security analytics, smart search, analyze, export — and replay-with-edit: resend a captured request against your fix.
Account & members
Status, usage-vs-limits, settings, and the audit log; switch, create, or delete accounts; members & RBAC; verification and KYC.
Billing
Subscription, invoices, and the billing portal; upgrade and preview a plan change; plans, coupons, add-ons, and dedicated IPs.
Credentials & auth
API keys, auth tokens, MFA, SSO / OIDC, and client CAs for mTLS — managed as reads and confirmed writes.
Monitoring
Create and manage alert rules and test a notification channel — so a threshold you describe becomes a live alert.
Support · boards · Iris
Open and search support tickets and the KB; product boards (create, move, and comment on cards); and Iris nudges and onboarding.
| Iris (in the dashboard) | MCP server (your AI client) |
|---|---|
| Drafts edge rules from plain English, gated by a confirmation card | Runs 150+ tools across your whole account from Claude or any MCP client |
| Lives in the ngris dashboard & forms | Lives in the AI assistant you already work in |
| Best for tuning policy while you're in the product | Best for staying in your editor / agent workflow |
When to use which
| If you want to… | Use |
|---|---|
| Add a new rule from a description | AI Generate button on the tab |
| Toggle / disable / delete / rename a rule | Iris chat |
| Change the order of rules | Iris chat or drag the card on the Routing Rules tab |
| Find the requests worth investigating | Smart-filter in the Traffic Inspector |
| Hand-edit many rules at once | YAML mode (Routing Rules / Traffic Policy tab) |
| “How do I configure X?” | Iris chat (it searches the docs + KB) |
If you type an edit intent (“disable…”, “delete…”) into AI Generate, it'll hand off to chat with your message pre-filled — one Enter away.
YAML mode
Routing Rules and Traffic Policy each have a Visual ↔ YAML toggle. Hand-edit, paste, or diff in version control; Apply replaces every rule under the policy atomically.
rules: - name: "API to api-backend" priority: 100 target_agent_id: "api-backend" enabled: true conditions: - match: path pattern: "/api/*"
rules: - phase: on_http_request rule_type: rate-limit name: "Login rate limit" priority: 50 enabled: true config: limit: 5 window: 60 scope: ip
The AI Generate button drops rules straight into the YAML editor when YAML mode is active — review and Apply, no modal needed.
Programmatic access
Every generator is also an HTTP endpoint — for scripted onboarding, infra-as-code seed scripts, or CI that drafts starting-point rules.
Built to be trusted
Iris acts on real infrastructure — so it asks before it changes anything, can only do what you could by hand, and records every action.
Confirm before every change
No write happens silently. Iris shows a confirmation card with a plain-language title and a field-by-field preview — create, update, or delete — and waits for your Approve.
Acts as you, never above you
Iris runs under your own session and role — it can only do what your permissions and plan allow. Out-of-scope and irreversible account actions are blocked on the server.
Every action is logged
Each change is recorded in an audit log on your account — what was done, when, and the outcome — so there's always a record you can review.
Dry-run before every rule write
For firewall, rate-limit, and traffic-policy rules, Iris replays your recent real traffic through the proposed change and shows how many requests it would newly block or throttle, how many were succeeding, and a safe / risky verdict — before you approve.
Cost & limits
Usage and write authority are both bounded per plan — so AI spend stays predictable and the assistant can't run away.
Token & rate budget
Every generate call and chat message counts against your plan's monthly token budget and per-hour message limit.
Per-plan action cap
The number of changes Iris can make per hour is capped per plan, so an unexpected loop can never run away.
Confirmed & logged
Nothing changes without your Approve, and every action is written to your account's AI activity log.
Let AI run your edge.
Start free and let Iris draft, tune, and audit your gateway — every change previewed and logged.