The line
Point an OpenAI-compatible client at the Kimss gateway and keep the model where it already runs. Azure AI Foundry, a private endpoint, your own host. Kimss does not take the weights.
OPENAI_BASE_URL=https://api.kimss.ai/v1
The Kimss key is the workspace key. Provider keys stay in your infrastructure.
What appears
The first routed call can create an inventory row without a separate registration form. That is zero-annotation discovery: the gateway sees the agent because the traffic came through it. Unnamed calls are labelled by model. A header names them when you want a name.
If that agent starts looping, you sever it at the gateway. Chats and runs that depend on the gate stop. You do not have to rotate the company-wide model key to stop one caller. You also cannot stop a process that never called the gateway. The switch is authoritative for routed traffic, and only for that.
What is free, and what is not
The original note bundled several controls into “it’s free.” The plan gates are sharper than that:
- Kill switch, identity, and shadow rows from routed traffic: Developer, free.
- Content safety and Prompt Shields: workspace baseline.
- PII and secret scrub: Production and above.
- Web search and internal MCP leaving the workspace: off until someone opts in.
- Threat Intercepts, the screen where you open a block: Production and above.
Developer is 25,000 governed requests a month. That is the free tier. It is not an unlimited gateway, and it is not a trial that silently converts. At the cap, calls get 429.
Guardrail detail is on Trust & safety.
Adapted from a LinkedIn note on 30 August 2026.