Ngris is a managed gateway-as-a-service: an agent makes an outbound connection to the edge, you get a public HTTPS hostname, and requests forward back to your local port with a web application firewall, rate limiting, identity-aware access, and observability built in. Iris is the ai assistant for your gateway that lives inside all of it. It isn't a bolt-on chatbot parked in the corner of the dashboard. It knows the platform cold, so it can answer how-to questions, draft your edge rules from plain English, answer questions about your account — “what endpoints do I have?”, members and roles, plan entitlements and quotas, verification — by reading the live API, search your HTTP traffic logs from a plain-English query, and explain why an individual request was blocked. It is a rule generator and assistant, not an autopilot: every write beyond firewall rules waits for your approval.
This post walks through what Iris does today, and — just as important — where the line sits. Iris drafts and suggests. You review and save. It never silently rewrites your config.
An AI assistant for your gateway, not next to it
Most "AI in the product" experiences are a generic chatbot wrapped around public docs. It can tell you what a rate limit is; it can't tell you what your rate limits are. Iris is different because it sits inside the gateway that's already terminating your TLS, running your traffic policies, and recording your requests.
That placement matters. When you ask Iris a question, it has the context that a sidecar chatbot doesn't: your endpoints, your traffic policies, your plan, your certificate state. When it drafts a firewall rule, it's producing the exact traffic-policy shape Ngris runs — not pseudocode you have to translate. And because it's part of the gateway, it can watch the same signals the platform sees and surface the ones worth your attention. The AI isn't a feature bolted to the side; it's an assistant that does real work inside the thing you're already using.
Ask it anything
The conversational side of Iris shows up in three places. There's an embeddable chat widget in the dashboard, a full-page chat if you want more room to work, and an "Ask AI" entry point in the docs so you don't have to leave the page you're reading to get an answer.
Because Iris knows the platform cold, the how-to questions can be concrete rather than generic:
- "How do I put a stable outbound IP in front of this endpoint so a partner can allowlist it?"
- "How do I attach the WAF to an endpoint, and what does detect mode do?"
- "What's the difference between an ephemeral and a reserved hostname, and how do I reserve one?"
- "Filter the Traffic Inspector to 429s on /login in the last hour" — Iris compiles that into a real filter.
It answers how-to and configuration questions grounded in how Ngris actually behaves, and it answers questions about your account — your endpoints, members and roles, plan entitlements and quotas, verification — by reading the live API rather than guessing. For your traffic it searches your logs from a plain-English query and hands back a real filter you can tweak and re-run, and for a single request it explains why that request was blocked. What it does not do is narrate a spike from your whole log history in one shot — it reasons per request. If you're new and just want the public hostname first, the answer is usually the same two commands you'd run anyway:
# authenticate the agent once, then expose a local port
ngris auth --token <token>
ngris http 3000Iris also helps you make sense of individual requests — pairing well with the live Traffic Inspector and request Replay when you're trying to figure out why one request behaved the way it did.
Describe a rule, get the config
The part platform engineers tend to care about most: you describe what you want in plain English, and Iris drafts the config. That covers firewall policies, rate-limit rules, traffic-policy rules, and custom error pages. Instead of hand-writing a policy and getting the phase ordering wrong, you say what you mean:
- "Block requests to /admin unless they carry a valid session cookie, and rate-limit login attempts to 10 per minute per IP."
- "Turn on the WAF in detect mode for this endpoint so I can watch it before I enforce."
- "Return a friendly 503 page when the upstream is unreachable."
Iris turns that into a traffic-policy rule of the right type in the right phase — Ngris supports 23 rule types across ordered phases (WAF, JWT, mTLS, rate limits, transforms), and getting them in the correct order by hand is exactly the kind of tedious work worth handing off. If you want the background on the firewall itself, see how the Coraza-powered WAF runs at the edge.
Two constraints are deliberate. First, rule generation is create-only: Iris drafts a new rule, it doesn't reach into an existing one and mutate it out from under you. Second, nothing ships until you review it. Iris hands you the config; you read it, adjust it, and save it. The default WAF posture reinforces this — it detects first, then blocks — so you get to watch a generated policy in the traffic logs before you let it start rejecting requests.
Draft a metric alert, get warned in time
Some conditions are worth knowing about before they bite. Describe a threshold in plain English and Iris drafts a metric-alert rule for you to review and enable — for example:
- Latency — "alert me if p95 latency goes over 300 ms on checkout."
- Usage burn — "warn me when I hit 80% of my data cap," so it's a heads-up rather than a surprise wall.
- Blocked traffic — "tell me when firewall-blocked requests spike."
An alert is a notification, not an action. When the condition is met it fires so you know to look; Iris drafts the alert, but it doesn't reconfigure your gateway on its own to "fix" a breach — the fix is still yours to apply. See generating metric alerts with AI for the full walkthrough. (Custom-domain TLS certificates are renewed automatically by the platform, independent of Iris.)
How to try it
Iris comes with the platform, so trying it is just a matter of getting an endpoint up and opening the assistant. Install the agent and expose a local port:
# macOS
brew install ngris
# Linux
curl -fsSL https://ngris.com/install.sh | sh
# Windows
winget install Ngris
# expose a local service and get a public HTTPS hostname
ngris http 3000The free plan gives you 5 endpoints with no credit card, which is plenty to spin up an endpoint, ask Iris to draft a rate-limit rule, review it, and attach the WAF in detect mode to see it work. Open the chat widget in the dashboard, describe what you're trying to do, and let Iris hand you a starting point. You stay in control of everything it produces — it drafts, you decide.