tare run

Run Tetrate Agent Router locally against real providers.

Serves an OpenAI-compatible endpoint on localhost backed by OpenAI and/or
Anthropic, with the tars-dataplane filter in the request path. Requires no
Kubernetes cluster, no management plane, and no identity file.

Needs two more artifacts than the CLI itself: tare-run-aigw and
libtare-run-composer.so. They are published in the same release channel as tare and
downloaded the first time this command runs, into a per-version cache, after
their checksums are verified against the signed release manifest. Supply them
yourself with --aigw-path and --module-path, and pass --no-fetch on a machine
that should not reach the network.

Only one instance can be up at a time on a machine, whatever --port says: the
Envoy Gateway extension server it starts binds a fixed port.

Provider credentials come from --openai-key-file / --anthropic-key-file, or
from TARE_RUN_OPENAI_KEY / TARE_RUN_ANTHROPIC_KEY. At least one is required,
unless --sync-config is delivering them from a management plane.

Caller authentication is always verified by the filter, using a signing key
generated for the run. --auth-key-file writes the resulting bearer token for
callers to present. --no-auth instead has Envoy stamp that token on every
request, so callers send nothing and any request is accepted.

MCP is not served here. A management plane's MCP routes are not projected into
this endpoint, and a joined run says so rather than leaving you to wonder.

--identity joins the management plane that issued the file, so callers present
that management plane's API keys. Add --sync-config to also receive live
configuration from it. Be deliberate about that: the sync runs the same worker
a real data plane runs, so it consumes that management plane's config events.
Point it at a management plane whose identity no live data plane is using.

Usage:
  tare run [flags]

Examples:
  # Anthropic only; any request is accepted
  export TARE_RUN_ANTHROPIC_KEY=sk-ant-...
  tare run --no-auth

  # Both providers; the caller token is written to ./caller.key
  tare run --openai-key-file ./openai.key --anthropic-key-file ./anthropic.key \
    --auth-key-file ./caller.key
  curl -H "authorization: Bearer $(cat ./caller.key)" ...

Flags:
      --aigw-path string            Path to the tare-run-aigw binary (or TARE_RUN_AIGW_PATH); defaults to the tare install directory
      --anthropic-key-file string   File containing the Anthropic API key (or set TARE_RUN_ANTHROPIC_KEY)
      --auth-key-file string        Write the generated caller bearer token to this file; callers present it
      --bind string                 Address to listen on; 0.0.0.0 exposes the endpoint to the network (default "127.0.0.1")
      --identity string             Join the management plane that issued this identity.json; callers then present that management plane's API keys
      --keep                        Keep the run directory on exit for inspection
      --liaison-path string         Override the liaison worker executable used by --sync-config (or TARE_RUN_LIAISON_PATH); defaults to re-executing this tare binary with the liaison subcommand. For development only
      --models-file string          Model catalogue to serve (default: a built-in catalogue of standard provider models)
      --module-path string          Directory containing libtare-run-composer.so (or TARE_RUN_MODULE_PATH); defaults to the tare install directory
      --no-auth                     Accept requests without a bearer token
      --no-fetch                    Never download the tare-run-aigw and libtare-run-composer.so this command needs. They are fetched from the release channel on first use and verified against the signed release manifest; this refuses instead, for an air-gapped machine or one that should not reach the network. Supply them with --aigw-path and --module-path
      --openai-key-file string      File containing the OpenAI API key (or set TARE_RUN_OPENAI_KEY)
      --port int                    Port for the local inference endpoint (default 1975)
      --run-dir string              Directory for generated config and state (default: a temporary directory)
      --sync-config                 With --identity, receive live config from the management plane. This CONSUMES that management plane's config events: if the identity belongs to a data plane that is also running, that data plane stops receiving its configuration
      --telemetry string            Reduce what is reported to the joined management plane: metadata-only (no request or response bodies) or off. Reporting itself is granted by that management plane and cannot be enabled here; an unjoined run reports nothing. Narrower than it sounds: it scopes that plane's copy of the REQUEST LOG only. Usage and billing events are reported regardless, and a local OTLP destination configured through OTEL_* in the environment still receives the full record

Global Flags:
  -q, --quiet     Suppress progress output; only errors and the final summary go to stderr
  -v, --verbose   Verbose output: plain-mode progress lines plus full per-blob chunk logs to stderr