Enterprise-Wide AI Tool Blocking
at Scale

#!/usr/bin/env python3
"""Enterprise AI tool lookup — single and bulk classification."""

import requests
import json

API_BASE = "https://api.aitoolsblocklist.com/v1"
API_KEY  = "your-enterprise-api-key"

def check_domain(domain: str) -> dict:
    """Query the blocklist for a single domain."""
    resp = requests.get(
        f"{API_BASE}/lookup",
        params={"domain": domain},
        headers={"Authorization": f"Bearer {API_KEY}"},
        timeout=5
    )
    resp.raise_for_status()
    return resp.json()

def bulk_check(domains: list) -> list:
    """Check up to 100 domains in a single API call.
       Use for daily proxy log analysis or SOAR enrichment."""
    resp = requests.post(
        f"{API_BASE}/bulk-lookup",
        json={"domains": domains},
        headers={"Authorization": f"Bearer {API_KEY}"},
        timeout=15
    )
    resp.raise_for_status()
    return resp.json()["results"]

# Single domain lookup
result = check_domain("chatgpt.com")
if result["is_ai_tool"]:
    print(f"MATCH: {result['domain']}")
    print(f"  Category:    {result['category']}")
    print(f"  Subcategory: {result['subcategory']}")
    print(f"  Risk Level:  {result['risk_level']}")

# Bulk check — feed proxy log domains for classification
proxy_domains = ["claude.ai", "midjourney.com", "github.com",
                 "deepseek.com", "perplexity.ai", "notion.so"]
results = bulk_check(proxy_domains)
ai_tools = [r for r in results if r["is_ai_tool"]]
print(f"\n{len(ai_tools)} of {len(proxy_domains)} domains are AI tools")
for tool in ai_tools:
    print(f"  {tool['domain']:25s} {tool['category']:25s} risk={tool['risk_level']}")

#!/bin/bash
# /etc/cron.daily/update-ai-blocklist.sh
# Download and validate the AI tools blocklist for local firewall consumption

API_KEY="your-enterprise-api-key"
FEED_URL="https://api.aitoolsblocklist.com/v1/feed/domains"
DEST="/etc/blocklists/ai-tools-all.txt"
TMP="/etc/blocklists/.ai-tools-tmp.txt"
LOG="/var/log/ai-blocklist-update.log"

# Full blocklist — all 18 categories
curl -sf -H "Authorization: Bearer $API_KEY" \
  "${FEED_URL}?format=plain" -o "$TMP"

LINES=$(wc -l < "$TMP" 2>/dev/null || echo 0)

if [ "$LINES" -gt 1000 ]; then
  mv "$TMP" "$DEST"
  echo "$(date -Is) OK: updated $DEST ($LINES domains)" >> "$LOG"
  # Reload the firewall/proxy so it picks up the new list
  systemctl reload squid 2>/dev/null || true
else
  rm -f "$TMP"
  echo "$(date -Is) FAIL: download too small ($LINES lines), kept previous" >> "$LOG"
fi

# Optional: category-filtered list for selective blocking
curl -sf -H "Authorization: Bearer $API_KEY" \
  "${FEED_URL}?format=plain&categories=ai-chatbots,ai-code-assistants" \
  -o "/etc/blocklists/ai-tools-high-risk.txt"