Prompt injection & jailbreaks
Malicious instructions ride inside ordinary prompts and tool output, bending models away from your intent.
Self-hosted · Single binary · Public beta
A security gateway for your AI infrastructure
One intelligent proxy layer between your applications and AI services. Get real-time monitoring, policy enforcement, and threat detection for LLM APIs, MCP servers, and A2A agents — with complete visibility over every request.
250+
Built-in detection rules
90+
REST API endpoints
80+
Guardrail test cases
5
Guardrail providers
OWASP
LLM Top 10 scoring
NIST
AI RMF aligned
The problem
AI moved into production faster than the controls to govern it
LLMs, MCP servers, and autonomous agents now touch real data and real systems — often with no proxy, no policy, and no audit trail. The gateway puts a single, inspectable control point in front of all of it.
Shadow AI
Models, tools, and agents get wired in without anyone sanctioning them — invisible until something goes wrong.
Runaway cost
Token spend compounds quietly across teams and keys with no budget, no threshold, and no way to cut it off.
Supply-chain & rug pulls
MCP tools and A2A agents can silently change behaviour or redirect traffic after you've already trusted them.
How it works
Point your clients at the gateway — it does the rest
The gateway sits inline as a proxy. Every request is inspected, scored, and either forwarded, redacted, or blocked — then logged with full attribution.
-
01
Connect
Create an MCP or LLM proxy and point Claude Desktop, Cursor, or your own app at it. OAuth 2.1 with Dynamic Client Registration means most clients connect with zero configuration.
-
02
Inspect & enforce
Each request runs the policy engine, third-party guardrail providers, agent-identity verification, budget checks, and PII redaction — concurrently, so latency tracks the slowest check, not the sum.
-
03
Route or block
Clean traffic is forwarded to the target AI service. Threats are blocked in real time, sensitive data is masked before it leaves, and shadow or quarantined assets are denied at the proxy.
-
04
Observe & audit
Watch it live on the dashboard, stream traces to Langfuse / Prometheus / OpenTelemetry, and keep a complete audit trail tied to both the human and the verified agent behind every action.
Inside the gateway — the life of a request
Every stage runs concurrently, so latency tracks the slowest check — not the sum of all of them.
See it in action
One dashboard for every proxy, policy, and alert
A real-time Vue interface ships inside the binary — no separate install.
What it offers
A complete control plane for AI traffic
A deep capability set across five pillars — from threat detection and cryptographic agent identity to cost governance, observability, and operations.
Custom security policies
250+ JSON-defined rules catch injection, path traversal, prompt injection, and jailbreaks — graded by severity and assigned per proxy.
Learn moreData redaction & unmasking
Mask PII, secrets, and sensitive content before it reaches the provider, then automatically restore the original values in the response — seamless for the end user.
Learn moreGuardrail providers
Fan out to Groq Safeguard, EnkryptAI, DynamoAI, GuardrailsAI, and Fiddler concurrently. Per-proxy or per-team, with fail-open/closed modes and a test playground.
Learn moreGuardrails evaluation
Automated penetration testing for your AI safety controls — 80+ cases across 12 categories, scored against OWASP LLM Top 10 and NIST AI RMF, including multi-turn attacks.
Learn moreMCP vulnerability scanner
Runtime security analysis of live MCP endpoints — tool-permission auditing, API-surface assessment, and malicious-payload detection wired into the policy engine.
Learn moreCanary token detection
A tripwire for data leakage — detects when a canary from one user or session surfaces in another, plus provider memorization and stale-canary signals.
Learn moreOAuth 2.1 proxy & DCR
RFC 7591 Dynamic Client Registration with RFC 8414 discovery and full PKCE. Upstream pass-through or full gateway authorization-server mode. Cursor and Claude Desktop work out of the box.
Learn moreCryptographic agent identity
Verify the agent workload itself — SPIFFE JWT-SVIDs & X.509-SVIDs (mTLS) and DIDs (did:key / did:web). Deny-biased per-agent tool rules, autonomy floors, and DPoP step-up.
Learn moreDelegation & revocation
Verifiable on-behalf-of delegation chains with a confused-deputy guard. Revoking an identity tears down its live A2A streams and SSE connections within seconds.
Learn moreHybrid auth & attribution
OAuth tokens and API keys work side by side on the same proxy. Every request is attributed to a user identity, email, timestamp, and risk score.
Learn moreRBAC & rate limiting
Admin / user / viewer roles with resource-ownership checks, plus per-user and per-tool sliding-window rate limits keyed down to user · proxy · tool.
Learn moreCross App Access (XAA)
Okta Identity-JAG token exchange for cross-application authorization, with JWKS caching, client-ID mapping, and bulk revocation. Experimental
Learn moreShadow-AI discovery & inventory
A governed inventory of every AI asset the gateway sees — providers, models, MCP tools, A2A agents, skills — that auto-flags anything observed but never sanctioned.
Learn moreEnforcement, not just reporting
Move an asset to quarantined or denied and it's blocked at the proxy on its next request — MCP tools, LLM models, or entire providers — via a live denylist.
Agentic Resource Discovery
Publish a standards-compliant /.well-known/ai-catalog.json and answer "what's available for this task?" via search, explore, and federation — the discovery layer in front of A2A, MCP, and skills.
A2A agent registry
Auto-discover agents via AgentCard URLs, invoke them with streaming responses, and track stateful tasks through their lifecycle — every call scored by the policy engine.
Learn moreRug-pull detection
Continuously watch MCP tools and A2A AgentCards for silent changes — URL redirects, dropped skills, capability flips — with severity scaled to how much changed.
Learn moreAI Security Skills Hub
A full MCP server that assistants connect to directly — submit skill source for content-addressable approval (any change resets to pending) and report suspicious runtime behaviour.
Learn moreBudget limits & cost control
Monthly USD limits per team or API key with configurable warning thresholds. Choose to warn or hard-block at the limit — exceeded requests get an HTTP 402.
Learn moreToken usage tracking
Monitor input/output tokens, cost, and usage patterns per proxy and per model, surfaced in the AI Usage Metrics dashboard.
Learn moreReal-time monitoring
A live dashboard of request rates, error rates, and security alerts, pushed over WebSocket with no polling. Advanced alert filtering and status workflow included.
Learn moreObservability & tracing
Send LLM traces to Langfuse, expose native Prometheus metrics, visualize in Grafana, and emit OpenTelemetry / Jaeger spans with p50/p95/p99 percentiles.
Learn moreSystem prompt governance
Automatically inject security controls and behavioural guidelines into LLM requests, priority-selected per proxy or user group, with template variables and audit logging.
Learn moreAlerting & notifications
Send alerts where your team already watches — SIEM, SOAR, Slack, email over SMTP, and webhooks — each with its own severity threshold.
Learn moreMulti-proxy management
Run unlimited MCP and LLM proxy instances side by side. Create, configure, start, stop, and restart each from one dashboard, over HTTP, WebSocket, or SSE.
Learn moreModern web interface
A Vue 3 dashboard with real-time status, an interactive alerts view, a visual policy editor, usage analytics, and full light/dark theming — responsive on desktop and mobile.
Learn moreFail-closed MCP tools
Tools are discovered automatically but disabled by default. A three-tier permission hierarchy — user override > group > global — decides exactly what each caller can invoke.
Learn moreSingle binary, your network
A pre-built Go binary for Linux, macOS, and Windows — no Docker required for the API server. Configurations, alerts, and logs persist in SQLite via GORM.
Learn moreAudit logging everywhere
Auth events, authorization failures, data changes, config changes, and security events are all logged — built for SOC 2, ISO 27001, HIPAA, and GDPR evidence.
Learn moreZero-config clients
Thanks to OAuth DCR and well-known discovery endpoints, MCP clients like Cursor IDE and Claude Desktop authenticate and start working without manual setup.
Learn moreExternal long-term storage
Replicate audit logs, alerts, and token usage to an external RDS database (PostgreSQL or MySQL) for long-term retention — real-time, batch, or hybrid sync.
Learn moreAutomated backups & restore
Schedule database snapshots from hourly to weekly with compression and a retention cap, browse every backup, and restore in one click from the Settings dashboard.
Learn more
Architecture
A clean, multi-layered design
A Vue front end talks to a single Go control plane over REST and WebSocket. That control plane manages unlimited proxy instances and persists everything to SQLite.
Port 80/443
Web interface
Real-time dashboard · proxy management · alerts · policy editor
REST API + WebSocket
Port 8080
Go backend — unified-admin
Multi-proxy service
Policy engine
Dashboard service
Alert management
Auth (JWT)
OAuth 2.1 handler
Database layer (GORM)
Database
Proxies · alerts · logs · users · tokens · tools · audit
Managed proxy instances
Proxy · MCP
→
Target MCP server
Proxy · LLM
→
OpenAI / Anthropic / …
Proxy · A2A
→
Registered agents
Standards & compliance
Built on open standards, mapped to the frameworks you report against
OWASP LLM Top 10
NIST AI RMF
MCP 2024-11-05
OAuth 2.1
PKCE · RFC 7636
DCR · RFC 7591
Discovery · RFC 8414
SPIFFE / SVID
DID · did:web / did:key
X.509 / mTLS
A2A protocol
ARD catalog
SOC 2
ISO 27001
HIPAA
GDPR
Guardrail providers
Groq Safeguard
EnkryptAI
DynamoAI DynamoGuard
GuardrailsAI
Fiddler AI
Observability
Langfuse
Prometheus
Grafana
OpenTelemetry
Jaeger
Identity providers
Google
GitHub
Azure AD
Okta
Auth0
Keycloak
Notifications
Slack
Email · SMTP
Webhooks
SIEM & SOAR
Splunk
QRadar
Azure Sentinel
SOAR
Storage & backups
RDS · PostgreSQL
MySQL
Automated backups
Quick start
Download, configure, run — no compilation required
Grab a pre-built release for your OS, generate two secrets, and start the gateway.
The dashboard comes up on localhost:8080.
# 1 · Download and extract the latest release
curl -LO https://github.com/syphon1c/ai-security-gateway/releases/latest/download/unified-admin-linux-amd64.tar.gz
tar -xzf unified-admin-linux-amd64.tar.gz
cd unified-admin-linux-amd64
# 2 · Run the installer (generates JWT + encryption keys)
chmod +x install.sh verify.sh start.sh
./install.sh
# 3 · Start the gateway → http://localhost:8080
./start.sh# 1 · Extract unified-admin-windows-amd64.zip, then:
cd unified-admin-windows-amd64
# 2 · Copy the env template and set your keys
Copy-Item env.example .env
notepad .env # set JWT_SECRET and ENCRYPTION_KEY
# 3 · Start the gateway
.\start.ps1The start script prints a one-time admin password on first run — save it, then change it after logging in. Full steps in the installation guide.
Put a control point in front of your AI
Self-hosted and yours to run. Download the beta, point your clients at it, and tell us what's missing.