v2026.8.1 is out. The first full release: security-reviewed, hardened, and out of beta. What's new →
Self-hosted · Single binary · v2026.8.1

A security gateway for your AI infrastructure

One intelligent proxy layer between your applications and AI services. Get real-time monitoring, policy enforcement, and threat detection for LLM APIs, MCP servers, and A2A agents, with complete visibility over every request.

Get started Browse the docs
  • No vendor lock-in
  • Single Go binary
  • Runs on your network
1,100+ Detection patterns, 23 policy packs
90+ REST API endpoints
85 Guardrail test cases, 14 categories
5 Guardrail providers
OWASP LLM Top 10 scoring
NIST AI RMF aligned
New · v2026.8.1

Out of beta, and hardened for it

The first full release closes the beta series. Every subsystem was re-audited, exercised end to end, and wired into the dashboards, audit trail, and alerting pipeline before it shipped, and the proxy layer stepped up to the newest MCP specification without dropping the old one.

  • MCP 2026-07-28 support

    Both MCP spec eras proxied side by side, with conformance enforcement, a compatibility bridge so modern clients still reach legacy servers, and an alert on every protocol downgrade.

  • Cross App Access, conformance-checked

    XAA now tracks IETF ID-JAG draft-04 and is verified against the xaa.dev reference implementation: single-use grants, signed audience-bound tokens, and RFC 9470 step-up. Experimental

  • Whole-platform security review

    Multi-pass backend review: fail-closed policy loading, skill guards, and tool-permission checks; SSRF guards on every outbound dial; body-size limits and LIKE-wildcard escaping across handlers.

  • Authentication & session hardening

    Server-side logout via JTI blacklist, instant session invalidation on role change, admin session management, forced password rotation, login rate limits, and a timing-oracle fix.

  • Secrets encrypted at rest

    Guardrail provider credentials, evaluation endpoint secrets, and inventory connector auth headers are encrypted at rest and masked in every API response.

  • Full DPoP proof verification

    RFC 9449 end to end. Proofs must be self-signed, match the pinned thumbprint, bind to the live request, stay fresh, and carry a single-use jti checked against a replay cache.

Read the full v2026.8.1 changelog
The problem

AI moved into production faster than the controls to govern it

LLMs, MCP servers, and autonomous agents now touch real data and real systems, often with no proxy, no policy, and no audit trail. The gateway puts a single, inspectable control point in front of all of it.

Prompt injection & jailbreaks

Malicious instructions ride inside ordinary prompts and tool output, bending models away from your intent.

Shadow AI

Models, tools, and agents get wired in without anyone sanctioning them, invisible until something goes wrong.

Runaway cost

Token spend compounds quietly across teams and keys with no budget, no threshold, and no way to cut it off.

Supply-chain & rug pulls

MCP tools and A2A agents can silently change behaviour or redirect traffic after you've already trusted them.

Who it is for

3 ways in, depending on what you own

Same gateway either way. What you set up first is the part that differs.

Security and risk teams

Know what AI is actually running, enforce a control that genuinely blocks, prove it works against a named framework, and produce the evidence.

Shadow-AI inventoryOWASP-scored testingAudit evidence
Start here

Platform and infrastructure

One process to deploy, a latency budget it respects, blast-radius control when a provider misbehaves, and metrics without writing instrumentation first.

One 37MB binaryCircuit breakersPrometheus · OTel
Start here

Agent and app builders

Client auth that configures itself, tools scoped to what the agent actually calls, PII kept out of the provider, and a spend limit that stops a runaway loop.

OAuth DCRFail-closed toolsHTTP 402 budgets
Start here
How it works

Point your clients at the gateway and it does the rest

The gateway sits inline as a proxy. Every request is inspected, scored, and either forwarded, redacted, or blocked, then logged with full attribution.

  1. 01

    Connect

    Create an MCP or LLM proxy and point Claude Desktop, Cursor, or your own app at it. OAuth 2.1 with Dynamic Client Registration means most clients connect with zero configuration.

  2. 02

    Inspect & enforce

    Each request runs the policy engine, third-party guardrail providers, agent-identity verification, budget checks, and PII redaction, all concurrently, so latency tracks the slowest check rather than the sum.

  3. 03

    Route or block

    Clean traffic is forwarded to the target AI service. Threats are blocked in real time, sensitive data is masked before it leaves, and shadow or quarantined assets are denied at the proxy.

  4. 04

    Observe & audit

    Watch it live on the dashboard, stream traces to Langfuse / Prometheus / OpenTelemetry, and keep a complete audit trail tied to both the human and the verified agent behind every action.

Inside the gateway: the life of a request

Every stage runs concurrently, so latency tracks the slowest check, not the sum of all of them.

Client apps Claude · Cursor · agents Identity OAuth 2.1 · SPIFFE · keys Policy engine 1,100+ patterns · risk score Guardrails 5 providers · fan-out Redaction PII & secrets masked Budget per team · per key AI service LLM · MCP · A2A Audit log · attribution · traces · WebSocket alerts Blocked · 403 alert raised · Slack / SIEM notified
See it in action

One dashboard for every proxy, policy, and alert

A real-time Vue interface ships inside the binary, with no separate install.

ai.gateway:8080 · AI Security Gateway
Security Dashboard showing 25 open critical alerts, 37 open high alerts, and status cards for security alerts, canary tokens, guardrail evaluations, skill security, MCP vulnerability scans, and change detection
What it offers

A complete control plane for AI traffic

A deep capability set across five pillars, from threat detection and cryptographic agent identity to cost governance, observability, and operations.

Custom security policies

213 JSON-defined rules, holding 1,100+ patterns across 15 policy packs and 8 compliance templates, catch injection, path traversal, prompt injection, and jailbreaks, graded by severity and assigned per proxy in priority order.

Regex engineRisk scoringReal-time block
Learn more

Data redaction & unmasking

Mask PII, secrets, and sensitive content before it reaches the provider, then automatically restore the original values in the response, seamless for the end user.

PIISecretsRound-trip
Learn more

Guardrail providers

Fan out to Groq Safeguard, EnkryptAI, DynamoAI, GuardrailsAI, and Fiddler concurrently. Per-proxy or per-team, with fail-open/closed modes and a test playground.

5 providersFan-out / fan-in
Learn more

Guardrails evaluation

Automated penetration testing for your AI safety controls: 85 built-in cases across 14 attack categories, scored against OWASP LLM Top 10 and NIST AI RMF, including multi-turn escalation. Author your own cases and import/export suites as JSON.

OWASPNIST AI RMFMulti-turn
Learn more

MCP vulnerability scanner

Runtime security analysis of live MCP endpoints: tool-permission auditing, API-surface assessment, and malicious-payload detection wired into the policy engine.

Runtime scanAuto-block
Learn more

Canary token detection

A tripwire for data leakage. It detects when a canary from 1 user or session surfaces in another, plus provider memorization and stale-canary signals.

Cross-userCross-sessionMemorization
Learn more

See all 46 capabilities, grouped and searchable

Built on

1 compiled binary, sized for the request path

The gateway sits inline, so it has to inspect every byte and never become the reason a request is slow. It is a single Go executable with no interpreter to install and no runtime to patch separately from the application.

37 MB Resident memory Whole control plane, 1 process
1.3 ms Health response Including the database check
1 File to deploy No runtime, no site-packages
0 Install-time dependencies Nothing resolved on the host

How it is built, and where an interpreted runtime would win

Standards & compliance

Built on open standards, mapped to the frameworks you report against

OWASP LLM Top 10 NIST AI RMF MCP 2026-07-28 + 2024-11-05 OAuth 2.1 XAA · ID-JAG draft-04 PKCE · RFC 7636 DCR · RFC 7591 Discovery · RFC 8414 SPIFFE / SVID DID · did:web / did:key X.509 / mTLS A2A protocol ARD catalog SOC 2 ISO 27001 HIPAA GDPR

Guardrail providers

Groq Safeguard EnkryptAI DynamoAI DynamoGuard GuardrailsAI Fiddler AI

Observability

Langfuse Prometheus Grafana OpenTelemetry Jaeger

Identity providers

Google GitHub Azure AD Okta Auth0 Keycloak

Notifications

Slack Email · SMTP Webhooks

SIEM & SOAR

Splunk QRadar Azure Sentinel SOAR

Storage & backups

RDS · PostgreSQL MySQL Automated backups
Quick start

Download, configure, run. No compilation required.

Grab a pre-built release for your OS, generate two secrets, and start the gateway. The dashboard comes up on localhost:8080.

bash 
# 1 · Download and extract the latest release
curl -LO https://github.com/syphon1c/ai-security-gateway/releases/latest/download/unified-admin-linux-amd64.tar.gz
tar -xzf unified-admin-linux-amd64.tar.gz
cd unified-admin-linux-amd64

# 2 · Run the installer (generates JWT + encryption keys)
chmod +x install.sh verify.sh start.sh
./install.sh

# 3 · Start the gateway → http://localhost:8080
./start.sh

The start script prints a one-time admin password on first run. Save it, then change it after logging in. Full steps in the installation guide.

Put a control point in front of your AI

Self-hosted and yours to run. Download v2026.8.1, point your clients at it, and see every request your AI stack makes.

Download v2026.8.1 Browse the docs