Confident Agent

Connect to internal AI endpoints behind firewalls without opening inbound ports.

Included on the Enterprise plan. Book a demo, opens in a new tab. Not included on the Team plan. Not included on the Starter plan. Not included on the Free plan.

The Confident Agent is a lightweight bridge agent that allows Confident AI's evaluation server to reach internal API endpoints behind firewalls, without opening inbound ports. This is a feature available as part of AI Connections.

GitHub Repository

View the source code, report issues, and find the latest releases.

How It Works

The agent connects outbound via WebSocket Secure (WSS) to Confident AI's evaluation server and waits for work. When an evaluation runs, requests are forwarded through the WebSocket tunnel to your internal endpoint and responses are relayed back.

No endpoint at all?

Use Handler Mode to connect an AI app that has no HTTP endpoint — implement a small handler function and the agent runs it locally instead of forwarding to a URL.

The Confident Agent supports the following response modes:

HTTP Response — standard JSON responses
HTTP Streaming — chunked HTTP streaming responses
SSE Streaming — Server-Sent Events streaming responses

sequenceDiagram
    participant E as Your Internal Endpoint
    participant A as Confident Agent
    participant C as Confident AI

    A->>C: Connect outbound (WSS/443)
    Note over A,C: WebSocket tunnel established

    C->>A: Forward evaluation request
    A->>E: Call internal endpoint
    E-->>A: Return response
    A-->>C: Relay response back
    Note over C: Evaluation continues

Requirements

Outbound internet access on port 443 (WSS) from the machine running the agent
Network access from the agent to your internal API endpoint
No inbound ports need to be opened

Air-Gapped Environments

Running in an air-gapped or egress-restricted network? Follow the air-gapped setup guide to distribute the image and configure outbound WSS allowlisting.

Quick Start

Docker Container (CLI)

Run the agent as a Docker container:

docker run -d \
  -e CONFIDENT_API_KEY=<your-api-key> \
  -e CONFIDENT_WS_BASE_URL=wss://deepeval.confident-ai.com/ws/relay \
  confidentai/confident-agent

Docker Compose

Create a compose.yaml file:

services:
  confident-agent:
    image: confidentai/confident-agent
    restart: unless-stopped
    environment:
      - CONFIDENT_API_KEY=${CONFIDENT_API_KEY}
      - CONFIDENT_WS_BASE_URL=${CONFIDENT_WS_BASE_URL:-wss://deepeval.confident-ai.com/ws/relay}

Then start the agent:

docker compose up -d

Native Packages

Prefer not to use Docker? The agent is also published as a native package — same behavior and configuration in every language:

# Python
pip install confident-agent
CONFIDENT_API_KEY=<your-api-key> confident-agent

# TypeScript / Node
npm install -g confident-agent
CONFIDENT_API_KEY=<your-api-key> confident-agent

# Rust
cargo install confident-agent
CONFIDENT_API_KEY=<your-api-key> confident-agent

Go (go get github.com/confident-ai/confident-agent/go) and Java (com.confident-ai:confident-agent on Maven Central) ship as libraries — import the package and start the agent from your own entry point. See each folder's README in the GitHub repository for details.

Environment Variables

Variable	Description	Required
`CONFIDENT_API_KEY`	Your Confident AI API key	Yes
`CONFIDENT_WS_BASE_URL`	WebSocket relay URL	No — defaults to `wss://deepeval.confident-ai.com/ws/relay`

Using with AI Connections

Once the Confident Agent is running and connected, your AI Connections can target internal endpoints that are not publicly accessible. The agent transparently tunnels requests from Confident AI's evaluation server to your internal endpoint—no changes to your AI Connection configuration are needed beyond pointing it to the internal URL.

Setting this up for your organization?Set up the controls your team needs before a wider rolloutTalk to us

Last updated on August 3, 2026