Skip to content
Guides & References

Iris on a public AI API: Anthropic, OpenAI or Google Gemini

Run Iris, rConfig's AI features, on a public AI API for the strongest answers with the least setup. What's sent, controlling cost, and when to move elsewhere.

Iris: AI CenterReference designUpdated
On this page

Iris on a public AI API: Anthropic, OpenAI or Google Gemini

In this design, Iris’s features use a public AI API: paste a key, pick a model, done. It gives the strongest answers on long, complicated configs with no hardware to run, and it’s where most teams start. The trade-off is that configs (with secrets obfuscated) go to the provider under its data terms.

What it looks like

flowchart LR
    R["rConfig server"] -- "outbound HTTPS<br/>(direct or via proxy)" --> P["Provider API<br/>Anthropic, OpenAI, Gemini"]
    R -.-> L[("rConfig audit trail<br/>user, feature, model, tokens")]

From V8.4.2, rConfig also offers Mistral, xAI, DeepSeek, Groq, Cohere and OpenRouter as providers. The design is the same; only the provider’s data terms and models differ.

What leaves your network

Each feature sends something different. The short version:

Feature Sends a config?
Config analysis Yes, on the first chat message
Drift narration The diff and the start of the current config
Compliance narration No; rule results only
Optimisation assistant No

The full table, including sizes and what’s never stored, is on the governance page. Secrets are obfuscated before anything leaves rConfig.

Controlling cost

  • Spend limits live in the provider’s console. rConfig doesn’t enforce a budget.
  • rConfig records tokens. Every request’s prompt and completion token counts are in the audit trail (GET /api/ai/audit-logs), by user and feature, so you can see where usage comes from.
  • Max Output Tokens caps each answer’s length, which trims cost a little, but long configs on the way in are the bigger cost driver.
  • Turn off features you don’t use in AI Configuration.

Pros

  • Best answer quality, especially on long firewall and core configs.
  • Minutes to set up; nothing to host.
  • New models arrive here first.

Cons

  • Configs go to the provider, under its data terms. Check those terms with your security team before connecting production devices.
  • Per-token cost that grows with use.
  • Needs outbound internet from the rConfig server.

Frequently asked questions

What does rConfig send to Anthropic, OpenAI or Gemini?

It depends on the feature. Config analysis sends the config on the first message; drift narration sends the diff and the start of the config; compliance narration sends rule results and no config. Secrets are obfuscated. The governance page lists each feature.

How do I limit what Iris costs on a public API?

Set spend limits and alerts in the provider's console. rConfig records token counts per request in its audit trail but doesn't enforce a budget. Max Output Tokens caps the length of each answer, not monthly spend.

Does rConfig need a direct internet connection for this?

It needs outbound HTTPS from the rConfig server to the provider's API. A proxy works if the server's outbound traffic goes through one.

Type to search.