Your Dify agent talks to everyone: keep its API calls in bounds

You built a support agent in Dify. It answers questions from your docs, and now you want it to do things too: look up an order in Stripe, issue a refund, open a GitHub issue.

Dify makes that easy. Add a tool, drop it into the agent, ship. Then a customer types "I want a refund for all my orders this year."

Your agent is no longer serving one person. It's serving everyone who opens the app. Every API call it makes uses your keys, on your accounts. So who decides which of those calls actually run?

This post covers why Dify is a great place to build agent apps, what Swytchcode adds when those agents call real APIs, and how to connect the two.

Why Dify

Dify is an open-source platform for building LLM apps. It puts workflows, RAG, agents, model management and observability in one place, and it's one of the most popular open-source AI projects on GitHub.

• A visual canvas. You build and test workflows by connecting blocks, not by writing glue code. Product people and engineers can work on the same app.
• RAG that's already done. Document ingestion, text extraction from PDFs and slides, and retrieval come out of the box.
• Any model. Hundreds of proprietary and open-source models from dozens of providers, plus self-hosted ones and anything OpenAI-compatible. You can switch models without rebuilding the app.
• Agents with tools. Agents can use tools from the Dify Marketplace, your own APIs, or any MCP server.
• Ship it as an app. Every app comes with a web UI and an API, so you can put it in front of customers or wire it into your backend.
• Self-host it. docker compose up -d on a machine with 2 cores and 4 GB of RAM. Your data stays on your servers.

Dify answers one question very well: how do I build and ship an agent app quickly?

It leaves a second one to you: when that agent calls Stripe or Gmail for a stranger, what keeps the call in bounds? To Dify, a tool call is a tool call. It doesn't know a balance lookup from a refund.

Why add Swytchcode

Swytchcode is an execution layer for API calls. Your Dify agent doesn't get a raw HTTP tool and an API key. It gets Swytchcode's MCP tools, and Swytchcode runs each call: with your credentials, against your rules, with a record of what happened.

Dify runs in Docker. Swytchcode runs on the host, and Dify reaches it as an MCP server over HTTP.

Your users (Dify web app or API)
      │
      ▼
Dify agent app  ── in Docker
      │  MCP over HTTP, bearer token
      ▼
swy mcp serve --profile operator  ── on the host
      │  policies, credentials, audit
      ▼
Stripe, Gmail, GitHub, ...

Here's what that gets you.

Keys stay off the canvas. You don't paste a Stripe key into a Dify tool config, where anyone with access to the workspace can see it. Swytchcode keeps credentials on the host. Dify only holds a token that unlocks a fixed set of 11 Swytchcode tools.

The agent knows the API. It asks Swytchcode "how do I refund a charge?" and gets the exact method, its inputs and its types. It can search for a provider, fetch it and enable the methods it needs. You don't hand-write an OpenAPI tool for every endpoint.

Writes wait for a person. Reads don't. Setup adds one baseline policy: every call that isn't a GET, HEAD or OPTIONS is held for approval. Order lookups run at once. The refund goes to you on Telegram or Slack, and runs only when you approve.

Rules live in code, not in the prompt. "Never refund more than $100" in your agent's instructions is a suggestion. A Swytchcode policy that blocks refunds over $100 is enforced on every call, whatever the user typed. The agent can add stricter rules. It can't remove one or approve its own request.

Sandbox first, and every call on record. New projects call each provider's test endpoint until you switch. swy audit shows each request, each policy decision and each approval.

Dify builds the agent. Swytchcode decides which of its API calls go through.

Three things to know

Approval doesn't block the chat. When a call needs approval, the tool returns "approval requested" straight away, and the call runs once someone approves it. The agent can tell the user "Your refund is waiting for approval." Don't build a workflow step that needs that call's result to continue.

One server, one project. Everyone who uses the Dify app shares the same Swytchcode project: its credentials, limits and approvals. If two apps need separate accounts or rules, run a server per project.

Reads run for anyone who uses the app. Only writes wait for approval. In a public app, a stranger can ask "list all my customers" and get your Stripe customer list. Before you put the app in front of customers, add policies that block or redact the reads they shouldn't see, or keep the app internal.

Set it up

You need self-hosted Dify (Dify Cloud can't reach your machine) and a Swytchcode account. Approvals need the Business or Enterprise plan. Run everything below on the Dify host.

1. Install swy

Pick one. Each installs swytchcode and its short alias swy.

npm install -g swytchcode
# or, on macOS / Linux
curl -fsSL https://cli.swytchcode.com/install.sh | sh

2. Create the project

swy init --operator --editor=none --project ~/agent-swy
swy login

--operator sets the project up for an agent, not a coding assistant. It starts in sandbox mode, adds the baseline approval policy, and writes the Swytchcode skill to ~/agent-swy/agent-skill/swytchcode-operator/.

3. Start the MCP server on the host

On macOS (Docker Desktop, swy 2.24.4 or later), the default address works:

swy mcp serve --profile operator --project ~/agent-swy --transport http -d

On Linux, listen on Docker's bridge:

BRIDGE=$(docker network inspect bridge --format '{{(index .IPAM.Config 0).Gateway}}')
swy mcp serve --profile operator --project ~/agent-swy --transport http --bind "$BRIDGE" -d

Also on Linux, Dify's ssrf_proxy container doesn't know host.docker.internal. Add it in docker/docker-compose.override.yaml:

services:
  ssrf_proxy:
    extra_hosts:
      - "host.docker.internal:host-gateway"

4. Let Dify reach the host

Dify sends outbound calls through an SSRF proxy that blocks private addresses, including your host. That's a good default. Allow just the one name you need in docker/.env:

SSRF_PROXY_ALLOW_PRIVATE_DOMAINS=host.docker.internal

Then restart the proxy:

docker compose up -d ssrf_proxy

Skip this and adding the server fails with 403 Forbidden.

5. Add the server in Dify

1. Open Tools → MCP → Add MCP Server (HTTP).
2. Set Server URL to http://host.docker.internal:5476/mcp, and Name and Server Identifier to swytchcode.
3. Under Headers, add Authorization with the value Bearer <token>. Get the token with swy mcp token.
4. Save. Dify lists the 11 Swytchcode tools.

6. Give your agent the tools and the rules

Dify has no skills, so the rules go in the prompt. In your Agent app, add the Swytchcode tools. Then paste the body of ~/agent-swy/agent-skill/swytchcode-operator/SKILL.md (everything below the --- header) into the agent's Instructions.

Those instructions teach the agent how to use Swytchcode. They don't enforce anything. The policies do that.

7. Connect an app and try it

Set your approval channel to Telegram or Slack at app.swytchcode.com, in a private chat with the Swytchcode bot. Then connect Stripe with a test key:

cd ~/agent-swy
swy get stripe
swy auth connect stripe

Stripe has no separate sandbox host, so the first call will ask you to set the base URL to https://api.stripe.com in manifest.json. The error names the exact entry. Most providers don't need this.

Open your agent app in Dify and ask:

Show my Stripe balance.

That's a read, so it runs. Now try:

Refund the last charge.

The agent finds the refund method and makes the call. Swytchcode holds it and replies "approval requested." The agent tells the user it's pending. Your phone buzzes. You check the amount, approve, and the refund goes through.

The short version

• Dify gives you a fast way to build, test and ship agent apps, with RAG, any model and MCP tools built in.
• Swytchcode runs on the host and governs each API call those agents make: known methods, your credentials, your rules, your approval, a full record.
• Reads run. Writes wait for a person. Keys never touch the canvas or the chat. The agent can add rules but never remove them.

Your Dify agent can talk to anyone. Swytchcode makes sure it only does what you'd sign off on.

Full reference: More personal agents in the Swytchcode docs. Try it in sandbox mode first, then tell us what your agent did.