Generate test traffic

Once a collector is installed and approved, the way to see the dashboard light up is to send a real AI request through it. This is also the honest end-to-end test: CA trust, proxy routing, and policy evaluation all exercised at once.

┌──────────────┐   HTTPS_PROXY     ┌──────────────────────┐         ┌─────────────────┐
│  agent host  │ ────────────────► │  your collector      │ ──ingest──►  kilasec.com  │
│  (a laptop / │  http://lan:8080  │  proxy :8080         │         │  /api/v1/ingest  │
│   test box)  │   + collector CA  │  PDP :8000           │         └─────────────────┘
└──────────────┘                   └──────────────────────┘

On the agent host

Trust the collector's CA (download it from the collector's detail panel on the Collectors page — see CA distribution), then route HTTPS through the collector and name the agent:

# Trust the CA (macOS example):
sudo security add-trusted-cert -d -p ssl \
  -k /Library/Keychains/System.keychain ~/kilasec-ca.pem

# Route HTTPS through the collector and tag the traffic:
export HTTPS_PROXY=http://<collector-ip>:8080
export HTTP_PROXY=http://<collector-ip>:8080
export SSL_CERT_FILE=~/kilasec-ca.pem
export AGENTFW_AGENT=my_test_agent
export ANTHROPIC_API_KEY=sk-ant-…

# Drive any agent or a one-off call:
python my_agent_script.py
# or a raw request:
curl https://api.anthropic.com/v1/messages -H "x-api-key: $ANTHROPIC_API_KEY" \
  -H "anthropic-version: 2023-06-01" -H "content-type: application/json" \
  -d '{"model":"claude-sonnet-4-6","max_tokens":16,"messages":[{"role":"user","content":"hi"}]}'

Every request that goes through HTTPS_PROXY lands on the collector, gets a verdict, and shows up on Live Traffic within a few seconds.

Want to see a rule fire? Put a secret in a prompt and watch the default redact_secrets_on_egress rule mask it before it reaches the provider (the response carries an X-Agentfw-Decision: redact header, and the Live Traffic row shows the redact verdict).

Common gotchas

• TLS handshake failures from the agent host. The collector's CA isn't trusted. Re-install it (macOS Keychain Access → System keychain → the CA cert → Get Info → "Always Trust").
• Decisions show up with unknown_agent. You didn't set AGENTFW_AGENT and the network didn't resolve a hostname. See Naming agents — or use the kilasec_agent package to tag it from inside the process.
• Nothing appears at all. Confirm the collector is online on the Collectors page and that the destination host is in your scope — out-of-scope hosts pass through without being inspected or logged.