Enterprise-Wide AI Tool Blocking
at Scale

#!/usr/bin/env python3
"""Enterprise AI tool lookup — download once, classify locally."""

import requests
import csv
import io

API_BASE = "https://www.aitoolsblocklist.com/api/database/"
API_KEY  = "your-enterprise-api-key"

def load_database() -> dict:
    """Download the full database CSV (domain,category,subcategory)
       and index it by domain for O(1) lookups."""
    resp = requests.get(
        API_BASE,
        params={"action": "download_database"},
        headers={"X-API-Key": API_KEY},
        timeout=120
    )
    resp.raise_for_status()
    return {row["domain"]: row
            for row in csv.DictReader(io.StringIO(resp.text))}

DB = load_database()  # refresh daily; database updates daily

def check_domain(domain: str) -> dict:
    """Check a single domain against the local copy."""
    return DB.get(domain)

def bulk_check(domains: list) -> list:
    """Check any number of domains with no additional API calls.
       Use for daily proxy log analysis or SOAR enrichment."""
    return [DB[d] for d in domains if d in DB]

# Single domain lookup
result = check_domain("chatgpt.com")
if result:
    print(f"MATCH: {result['domain']}")
    print(f"  Category:    {result['category']}")
    print(f"  Subcategory: {result['subcategory']}")

# Bulk check — feed proxy log domains for classification
proxy_domains = ["claude.ai", "midjourney.com", "github.com",
                 "deepseek.com", "perplexity.ai", "notion.so"]
ai_tools = bulk_check(proxy_domains)
print(f"\n{len(ai_tools)} of {len(proxy_domains)} domains are AI tools")
for tool in ai_tools:
    print(f"  {tool['domain']:25s} {tool['category']:25s} {tool['subcategory']}")

#!/bin/bash
# /etc/cron.daily/update-ai-blocklist.sh
# Download and validate the AI tools blocklist for local firewall consumption

API_KEY="your-enterprise-api-key"
FEED_URL="https://www.aitoolsblocklist.com/api/database/?action=download_database"
DEST="/etc/blocklists/ai-tools-all.txt"
TMP="/etc/blocklists/.ai-tools-tmp.txt"
LOG="/var/log/ai-blocklist-update.log"

# Full blocklist — all 18 categories; extract the domain column from the CSV
curl -sf -H "X-API-Key: $API_KEY" "$FEED_URL" \
  | tail -n +2 | cut -d, -f1 > "$TMP"

LINES=$(wc -l < "$TMP" 2>/dev/null || echo 0)

if [ "$LINES" -gt 1000 ]; then
  mv "$TMP" "$DEST"
  echo "$(date -Is) OK: updated $DEST ($LINES domains)" >> "$LOG"
  # Reload the firewall/proxy so it picks up the new list
  systemctl reload your-proxy-service 2>/dev/null || true
else
  rm -f "$TMP"
  echo "$(date -Is) FAIL: download too small ($LINES lines), kept previous" >> "$LOG"
fi

# Optional: category-filtered list — filter the CSV client-side
curl -sf -H "X-API-Key: $API_KEY" "$FEED_URL" \
  | awk -F, 'NR>1 && ($2=="Conversational & Chatbots" || $2=="Code & Development") {print $1}' \
  > "/etc/blocklists/ai-tools-high-risk.txt"