A tool runs locally, so the model’s decision to call a tool first appears in the response, and the tool’s result appears in the developer’s next request:
sequenceDiagram
participant Agent as Coding agent
participant Kong as Kong Gateway
participant LLM
Note over Agent,LLM: Turn N, the model decides to run a tool
LLM-->>Kong: Response with tool_use
Kong-->>Agent: Streaming, client already has tool_use
Note over Agent: Tool runs on the developer's machine
Agent->>Kong: Turn N+1, messages include tool_result
Note over Kong: Straiker Defend can deny here,
stopping the model from consuming a poisoned result
Straiker Coding Agent Streaming runs in the access phase, and relays the response asynchronously when config.relay_response is enabled:
sequenceDiagram
autonumber
participant Agent as Claude Code
participant Plugin as Straiker Coding Agent
Streaming plugin
participant Defend as Straiker Defend
participant LLM as Anthropic
Agent->>Plugin: POST /v1/messages
Plugin->>Defend: request phase
Defend-->>Plugin: verdict
alt If prompt or poisoned tool_result denied
Plugin-->>Agent: HTTP 200 end_turn (policy text)
else If allowed
Plugin->>LLM: Forward
LLM-->>Agent: Stream (untouched)
Plugin-->>Defend: async response relay
end
Because Straiker Coding Agent Streaming can’t hold the response, it can’t stop a tool_use before the client runs it. Use the buffered plugin when a tool call must be stopped before it runs, for example in CI or unattended agents.
Straiker Coding Agent Streaming runs at priority 1000, so it reads the client body before AI Proxy or AI Proxy Advanced (both priority 770) would translate it. For more information, see plugin priority.
AI Proxy can front Straiker Coding Agent Streaming. It still inspects prompts and tool results normally.
Set this before attaching Straiker Coding Agent Streaming. At Kong Gateway’s 8 KB default client_body_buffer_size, a Claude Code request body (often 138 KB, over 1 MB with a large tool set) spills to an nginx temp file, the plugin can’t read the raw body, and traffic is proxied without inspection, returning HTTP 200 with x-straiker-verdict: fail-open-no-body.
nginx_http_client_body_buffer_size = 32m
Or set KONG_NGINX_HTTP_CLIENT_BODY_BUFFER_SIZE=32m. Also raise nginx_http_client_max_body_size to 64m. This setting is node-level and needs a restart to take effect. If you can’t set it, for example on a fully Konnect-managed data plane, request-body inspection isn’t possible.
Straiker Coding Agent Streaming only inspects paths that end in /v1/messages, not /v1/messages/count_tokens. If your Route rewrites that suffix away, there’s no x-straiker-verdict header at all.
