An HTTP relay for AI agents that fetch URLs

Where it goes wrong

Tool-calling models routinely invent URLs, follow instructions found inside fetched pages, and retry aggressively. Handing that loop a raw fetch() with no allow-listing means every prompt injection is a potential interior network scan.

What Backfire handles

• Non-public ranges are refused before any connection is opened, on IPv4 and IPv6.
• Ambiguous DNS fails closed instead of guessing which address to trust.
• Redirects are returned, never followed — the model cannot hop somewhere else silently.
• Every tool call is logged with its target, status, byte counts and duration for replay and review.

The request

// give the model exactly one outbound tool
const res = await fetch('https://backfireapi.base44.app/functions/forward', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.BACKFIRE_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    url: toolCall.args.url,
    method: 'GET',
    timeout_ms: 8000,
  }),
});

const envelope = await res.json();
if (!envelope.ok) return { error: envelope.error.code };
return { status: envelope.upstream.status, body: envelope.body };

All use cases