# Guard proxy

> porticol-cli guard proxy: serve Guard's local proxy for a sandboxed agent.

Canonical: https://porticol.app/docs/cli/guard-proxy

[View as Markdown](https://porticol.app/docs/cli/guard-proxy.md)

## Examples

```
porticol-cli guard proxy
porticol-cli guard proxy --port 7788 --data-dir ~/porticol
```

## Usage

```
porticol-cli guard proxy [--port 7777] [--data-dir <path>]
```

## Options

| Option | What it does |
| --- | --- |
| `--port <port>` | the port to listen on, 7777 by default |
| `--data-dir <path>` | the workspace to serve: PORTICOL_DATA_DIR, or the desktop's data folder |

## Guard proxy

The proxy listens on 127.0.0.1 only. A CONNECT to a host the policy names is decrypted and decided: the key the policy names is injected, a call the policy asks about waits up to a minute for a person, and every call is recorded. Any other host is tunnelled untouched. The desktop runs the same proxy at launch when an agent was set up with Guard.

## Exit codes

| Code | Meaning |
| --- | --- |
| 0 | the proxy stopped when asked |
| 3 | the command line, the data folder or the certificate authority is wrong |

## See also

- [this text, with examples](https://porticol.app/docs/cli.html)
- [Guard on your machine](https://porticol.app/docs/ai-agents.html)