Onboarding Guide

Cirrus Argus is an AI Gateway — an OpenAI-compatible proxy that routes LLM requests across multiple providers (OpenAI, Anthropic, Google, AWS Bedrock, and more) behind a single API. It adds spend controls, rate limiting, virtual keys, RBAC, observability, and MCP-tool integration on top of the raw provider APIs.

You use Argus when you want to:

• Call multiple LLM providers without rewriting your client code
• Enforce per-key spend caps and rate limits across an organization
• Track usage, latency, and cost at the request level
• Inject MCP tools into chat completions without managing per-tool plumbing
• Keep provider credentials encrypted and audited

This portal is the user-facing surface. Admins also have access to the Control Plane, where they manage providers, roles, compliance policies, and the like. If you hold admin-like capabilities you'll see an Admin Console link in the portal nav.

How you sign in depends on how your organization is provisioned:

• SSO — most production tenants use SAML or OIDC against the org's identity provider. Click Sign In and you'll be redirected to your IdP.
• Email + password — used for standalone accounts and during initial bootstrap. Your administrator provisions the account; a one-time link arrives by email.

On first sign-in you land on My Access — the home for everything tied to your identity (virtual keys, MCP credentials, personal access tokens, key-request status).

Virtual keys are how you authenticate to the proxy. They're separate from provider API keys (which stay encrypted in the gateway's vault). A virtual key carries the policies the gateway enforces:

• Allowed models
• Allowed providers (and which credential to use per provider)
• Spend cap (USD per period)
• Rate limit (requests per minute / day)
• Environment (dev / staging / prod)

To create one:

1. From the portal nav, open My Access.
2. Click Create Virtual Key.
3. Pick a name (e.g. local-dev) and optional model / provider restrictions.
4. The plaintext key is displayed once. Copy it now — Argus only stores the SHA-256 hash, so a lost key must be rotated.

Need a key your admin has to approve? Submit a Key Request from the same page — admins review it in the control plane and the approved key is delivered by email.

Argus's /v1/models endpoint returns the models your key can actually call, not the gateway-wide catalog. The list reflects the intersection of the configured providers and the key's allowedModels / providerMap restrictions.

Search by name, filter by capability, or paginate:

For a single model — pricing, context window, capabilities — call the detail endpoint:

Need to pull pricing for a budgeting or FinOps tool? /v1/pricing returns the full table with provider and substring filters, prices already normalized to per-1M tokens:

You can also browse the catalog visually in the AI Services directory — same data, with cards and filtering.

Every virtual key carries its own enforcement envelope, evaluated on each request:

• Spend cap — a USD ceiling per period (daily / monthly / total). When exceeded the gateway 402s; the spend counter is updated post-response so cost is debited at the rate the upstream actually returned.
• Rate limits — requests-per-minute and requests-per-day, enforced via Redis token buckets. 429 with Retry-After on overflow.
• Allowed models — a model not on the allowlist returns 403 model_not_allowed.
• Allowed providers — when restrictProviders is on, only models served by the providers in providerMap are reachable.

Personal keys: configure these on My Access → key detail.

Team / shared keys: admins set them in the control plane under Keys. If you don't have access, file a Key Request.

Argus is also an MCP gateway. Tools and resources from registered MCP servers can be injected into chat completions via the agentic loop: Argus discovers the relevant tools for the request, presents them to the model, and intercepts tool calls to dispatch them to the upstream server.

Discover what's available to your key:

To activate the agentic loop on a single call, set x-argus-mcp: true (or have your admin set agenticMcpDefault on the key):

You can also browse the MCP catalog in the MCP Directory — same scope rules as the API surface (org-bounded, team / user narrowed where applicable).

Your spend, token volume, and request history live on the Usage tab — totals, time-bucketed trends, and per-key drilldown.

For programmatic access (CI cost gates, FinOps reports, scheduled budget alerts) the same data is served by /v1/usage:

The endpoint is scoped to the calling key only — even an instance admin sees no cross-key data here. Cross-key analytics for org-wide rollups live under the admin proxy-analytics surface in the control plane.

There is no Argus-specific SDK to install. Because the gateway is OpenAI-compatible, you use the official openai client (or any library that accepts a custom base URL) and point it at the Argus gateway with your virtual key.

• TypeScript / Node.js — the openai npm package, plus the Vercel AI SDK.
• Python — the openai Python package (sync and async), plus LangChain.
• Overview — side-by-side snippets for both languages and the common frameworks.