A tool runs locally, so the model’s decision to call a tool first appears in the response, and the tool’s result appears in the developer’s next request.
Straiker Coding Agent Buffered holds that response until Straiker Defend scores it, so the agent never sees a denied tool_use:
sequenceDiagram
autonumber
participant Agent as Claude Code
participant Plugin as Kong Gateway
buffered plugin
participant Defend as Straiker Defend
participant LLM as Anthropic
Agent->>Plugin: POST /v1/messages
Plugin->>Defend: request phase
Defend-->>Plugin: verdict
alt Request denied
Plugin-->>Agent: HTTP 200 end_turn
else Allowed
Plugin->>LLM: Forward
LLM-->>Plugin: Full response (held)
Plugin->>Defend: response-sync
Defend-->>Plugin: verdict
alt tool_use denied
Plugin-->>Agent: HTTP 200 end_turn
tool never reaches the agent
else Allowed
Plugin-->>Agent: Model response
end
end
Straiker Coding Agent Buffered runs in the access and response phases:
access: Sends the incoming request to Straiker Defend and denies it before it reaches the model if the verdict says to.response: Holds the full model response, sends it to Straiker Defend for synchronous scoring, and only forwards it to the agent once the scan passes.
Holding the response adds latency to the first token, typically around 1.2 times the median time-to-first-token, because the agent doesn’t see anything until generation finishes and scoring completes.
Use the streaming plugin instead for interactive developers who need immediate tool execution.
Caution: Don’t attach Straiker Coding Agent Buffered to a Route that also uses AI Proxy or AI Proxy Advanced.
AI Proxy clears Kong Gateway’s response buffering (ctx.buffered_proxying) whenever the client streams, and coding agents always stream.
Straiker Coding Agent Buffered then silently stops enforcing while still returning an HTTP 200 with x-straiker-verdict: allow.
Inject the upstream credential with Request Transformer instead.
If you need AI Proxy in front of your coding-agent traffic, use the streaming plugin on that Route instead.
It still inspects prompts and tool results, and isn’t affected by this restriction.
Straiker Coding Agent Buffered runs at priority 1000, so it reads the client body before AI Proxy (priority 770) would translate it. For more information, see plugin priority.
Set this before attaching Straiker Coding Agent Buffered. At Kong Gateway’s 8 KB default client_body_buffer_size, a Claude Code request body (often 138 KB, over 1 MB with a large tool set) spills to an nginx temp file, the plugin can’t read the raw body, and traffic is proxied without inspection, returning HTTP 200 with x-straiker-verdict: fail-open-no-body.
nginx_http_client_body_buffer_size = 32m
Or set KONG_NGINX_HTTP_CLIENT_BODY_BUFFER_SIZE=32m. Also raise nginx_http_client_max_body_size to 64m. This setting is node-level and needs a restart to take effect. If you can’t set it, for example on a fully Konnect-managed data plane, request-body inspection isn’t possible.
Straiker Coding Agent Buffered only inspects paths that end in /v1/messages, not /v1/messages/count_tokens. If your Route rewrites that suffix away, there’s no x-straiker-verdict header at all.
Unlike straiker, setting config.fail_open to false on Straiker Coding Agent Buffered also applies to the response phase.
Because the model’s answer is only generated once, setting fail_open to false can return a 503 for a request whose response was already produced by the model, if Straiker Defend is unreachable when the response is scored.
