Ngris is a managed gateway-as-a-service: an agent makes an outbound connection to the edge, you get a public HTTPS hostname, and requests forward back to your local port with a web application firewall, rate limiting, identity-aware access, and observability built in. Iris is the ai assistant for your gateway that lives inside all of it. It isn't a bolt-on chatbot parked in the corner of the dashboard. It knows the platform and it knows your account, so it can answer how-to questions, draft rules from plain English, and flag problems before they page you.
This post walks through what Iris does today, and — just as important — where the line sits. Iris drafts and suggests. You review and save. It never silently rewrites your config.
An AI assistant for your gateway, not next to it
Most "AI in the product" experiences are a generic chatbot wrapped around public docs. It can tell you what a rate limit is; it can't tell you what your rate limits are. Iris is different because it sits inside the gateway that's already terminating your TLS, running your traffic policies, and recording your requests.
That placement matters. When you ask Iris a question, it has the context that a sidecar chatbot doesn't: your endpoints, your traffic policies, your plan, your certificate state. When it drafts a firewall rule, it's producing the exact traffic-policy shape Ngris runs — not pseudocode you have to translate. And because it's part of the gateway, it can watch the same signals the platform sees and surface the ones worth your attention. The AI isn't a feature bolted to the side; it's an assistant that does real work inside the thing you're already using.
Ask it anything
The conversational side of Iris shows up in three places. There's an embeddable chat widget in the dashboard, a full-page chat if you want more room to work, and an "Ask AI" entry point in the docs so you don't have to leave the page you're reading to get an answer.
Because Iris knows both the platform and your account, the questions can be concrete rather than generic:
- "How do I put a stable outbound IP in front of this endpoint so a partner can allowlist it?"
- "Which of my endpoints don't have the WAF attached yet?"
- "What's the difference between an ephemeral and a reserved hostname, and how do I reserve one?"
- "Help me read this spike in 429s in the Traffic Inspector."
It answers how-to and configuration questions grounded in how Ngris actually behaves. If you're new and just want the public hostname first, the answer to that last question is usually the same two commands you'd run anyway:
# authenticate the agent once, then expose a local port
ngris auth --token <token>
ngris http 3000Iris also helps you make sense of traffic and logs — pairing well with the live Traffic Inspector and request Replay when you're trying to figure out why a request behaved the way it did.
Describe a rule, get the config
The part platform engineers tend to care about most: you describe what you want in plain English, and Iris drafts the config. That covers firewall policies, rate-limit rules, traffic-policy rules, and custom error pages. Instead of hand-writing a policy and getting the phase ordering wrong, you say what you mean:
- "Block requests to /admin unless they carry a valid session cookie, and rate-limit login attempts to 10 per minute per IP."
- "Turn on the WAF in detect mode for this endpoint so I can watch it before I enforce."
- "Return a friendly 503 page when the upstream is unreachable."
Iris turns that into a traffic-policy rule of the right type in the right phase — Ngris supports 23 rule types across ordered phases (WAF, JWT, mTLS, rate limits, transforms), and getting them in the correct order by hand is exactly the kind of tedious work worth handing off. If you want the background on the firewall itself, see how the Coraza-powered WAF runs at the edge.
Two constraints are deliberate. First, rule generation is create-only: Iris drafts a new rule, it doesn't reach into an existing one and mutate it out from under you. Second, nothing ships until you review it. Iris hands you the config; you read it, adjust it, and save it. The default WAF posture reinforces this — it detects first, then blocks — so you get to watch a generated policy in the traffic logs before you let it start rejecting requests.
It watches so you don't have to
Not everything worth knowing is something you'll think to ask. Iris also runs proactively, watching for conditions that tend to bite later, and surfaces a nudge in the dashboard when it finds one:
- Certificate expiry — a custom-domain cert getting close to its renewal window, before it turns into a downtime incident.
- Usage burn — you're on track to hit a plan limit, so it's a heads-up rather than a surprise wall.
- Weak security posture — an endpoint exposed without the WAF attached, or access that could be tightened with identity-aware SSO/OIDC instead of left open.
A nudge is a prompt, not an action. Iris tells you what it noticed and what it would suggest; the fix is still yours to apply. The point is to move the moment you learn about a problem earlier — before the cert lapses, before the limit is hit — without turning the gateway into something that changes itself while you're asleep.
How to try it
Iris comes with the platform, so trying it is just a matter of getting an endpoint up and opening the assistant. Install the agent and expose a local port:
# macOS
brew install ngris
# Linux
curl -fsSL https://ngris.com/install.sh | sh
# Windows
winget install Ngris
# expose a local service and get a public HTTPS hostname
ngris http 3000The free plan gives you 5 endpoints with no credit card, which is plenty to spin up an endpoint, ask Iris to draft a rate-limit rule, review it, and attach the WAF in detect mode to see it work. Open the chat widget in the dashboard, describe what you're trying to do, and let Iris hand you a starting point. You stay in control of everything it produces — it drafts, you decide.