Skip to main content

CertOps Local Bridge

While the CLI excels as an automated Gatekeeper in your CI/CD pipelines, testing and evaluating AI responses shouldn't require you to commit your code, wait for a build, and deploy to a staging environment just to see if your latest prompt tweak improved performance.

The CertOps Local Bridge (Hybrid Mode) allows you to securely expose a local service running on your laptop directly to the CertOps evaluation engine.

This makes life significantly easier for developers. You can run massive, high-volume regression matrices comparing your uncommitted local code directly against the hosted production baseline—all without leaving your development environment.

How it Works​

When you trigger a run using the CLI, you can pass local:PORT instead of a public HTTPS URL. An optional path suffix is preserved (local:8080/agent2).

# Target 1 (retriever) matches against the public prod endpoint
# Target 2 (generator) matches against your local development server
certops run --host "target1=https://prod-api.acme.com" --host "target2=local:8080"
  1. Detection: The CLI parses the --host arguments. When it detects the local: prefix, it initiates the Bridge Protocol.
  2. One Multiplexed Tunnel: The CLI launches a single background frpc process that tunnels every local target over one TLS connection with TCP multiplexing (tcpMux) — critical, because the SaaS fires 1,000+ requests and a per-target connection would choke on overhead.
  3. Subdomain Generation: The server hands the CLI a subdomain prefix at login, computed as {emailLocalPart}_{tenantId}. Each target is exposed at https://{prefix}-{target_id}.{relay_host} — e.g. https://alice_acme-generator.dev.certops.ai. The relay host comes from the login response, never hardcoded.
  4. Runtime Swap: The CLI sends the ephemeral HTTPS URL in the run request, replacing local:8080 before submitting the evaluation matrix to the SaaS backend.
  5. High-Volume Execution: The CertOps SaaS fires its evaluation load (e.g., 1,000+ dataset samples) at the ephemeral URL. The requests are securely tunneled down to your local process.
  6. Teardown: Once the evaluation matrix completes or you press Ctrl+C, the CLI closes the tunnel and exits 2. Note that Ctrl+C stops the tunnel locally but the run continues server-side — there is no cancel endpoint yet, so use certops status <run_id> to re-attach.

Security Guardrails​

The Local Bridge was designed with enterprise security in mind:

  • Encrypted Traffic: All local evaluation traffic is end-to-end tunneled via TLS.
  • Authentication Injection: Tunnels cannot be opened anonymously. The CLI injects your secure session token into the tunnel configuration to prevent unauthorized use of the Relay.
  • Ephemeral Scoping: The public endpoint only exists for the exact duration of the certops run process constraint. As soon as the PID dies, the bridge collapses.