Everything the gateway does, grouped and searchable. Each capability links straight to its guide in the documentation.
213 JSON-defined rules holding 1,100+ patterns across 15 policy packs and 8 compliance templates. Injection, path traversal, prompt injection, and jailbreaks are graded by severity, assigned per proxy, and evaluated in a deterministic priority order.
Read the guideMask PII, secrets, and sensitive content before it reaches the provider, then restore the original values in the response. The end user never sees the difference; the provider never sees the data.
Read the guideRuntime security analysis of live MCP endpoints: tool-permission auditing, API-surface assessment, malicious-payload detection, and tool-schema safety analysis, all wired into the policy engine with a triage workflow.
Read the guideRequests that declare the modern spec are held to it: batches, missing or mismatched protocol headers, and versions below your pinned floor are refused with spec-correct errors, and a server prompt phishing for credentials raises an alert. Enforce or observe, per proxy.
Read the guideA tripwire for data leakage. It detects when a canary from 1 user or session surfaces in another, using sliding-window extraction that defeats evasion, plus provider memorization and stale-canary signals.
Read the guideContinuously watch MCP tools and A2A AgentCards for silent changes: URL redirects, dropped skills, and capability flips. Baselines are fail-closed and severity scales with how much actually changed.
Read the guideAn always-on heuristic engine over every MCP and LLM proxy request, flagging automated scanning, attack sequences, and anomalous content patterns. Monitor-only by design, so it surfaces behaviour without blocking it.
Read the guideA surgical kill switch. Block 1 user, API key, or IP without stopping the proxy or disrupting anyone else. Quarantined sessions are rejected at the earliest point in the pipeline, before any content analysis or upstream call.
Read the guideSend alerts where your team already watches: SIEM, SOAR, Slack, email over SMTP, and webhooks, each with its own severity threshold and delivery rules.
Read the guideFan out to Groq Safeguard, EnkryptAI, DynamoAI DynamoGuard, GuardrailsAI, and Fiddler concurrently. Configure per proxy or per team, with fail-open and fail-closed modes, health checks, and a test playground.
Read the guideAutomated penetration testing for your AI safety controls: 85 built-in cases across 14 attack categories, scored against OWASP LLM Top 10 and NIST AI RMF, including multi-turn escalation attacks. Runs are async and cancellable.
Read the guideAuthor your own single-turn and multi-turn cases with a guided turns editor. Compliance mappings are inherited from the category, and whole suites import and export as JSON. Built-in cases stay immutable.
Read the guideAn in-dashboard playground for exercising proxy authentication end to end, including the full OAuth flow, so you can confirm a client will connect before you wire it up for real.
Read the guideInject security controls and behavioural guidelines into LLM requests automatically, priority-selected per proxy or user group, with template variables and full audit logging.
Read the guideRFC 7591 Dynamic Client Registration with RFC 8414 discovery and full PKCE. Run as an upstream pass-through or as a complete gateway authorization server. Cursor and Claude Desktop connect with no manual setup.
Read the guideVerify the agent workload itself: SPIFFE JWT-SVIDs and X.509-SVIDs over mTLS, plus DIDs (did:key and did:web). Deny-biased per-agent tool rules, autonomy floors, and proof-of-possession step-up.
Read the guideRFC 9449 enforced end to end. Proofs must be signed by their own embedded key, match the pinned thumbprint, bind to the live request, stay fresh within 60 seconds, and carry a single-use jti checked against a replay cache.
Verifiable on-behalf-of delegation chains with a confused-deputy guard. Revoking an identity tears down its live A2A streams and SSE connections within seconds.
Read the guideOAuth tokens and API keys work side by side on the same proxy. Every request is attributed to a user identity, email, timestamp, and risk score.
Read the guideTools are discovered automatically but disabled by default. A 3-tier hierarchy (user override, then group, then global) decides what each caller may invoke, with sliding-window limits keyed down to user, proxy, and tool.
Read the guideAdmin, user, and viewer roles with resource-ownership checks, plus user groups and assignment rules that map identity-provider claims onto teams, proxies, and tool permissions automatically.
Read the guideAdmins can list and revoke any user's active sessions. Role changes and account disables invalidate sessions immediately, logout revokes server-side via a JTI blacklist, and per-user session caps stop unbounded growth.
Read the guideUse your existing downstream service tokens as gateway credentials instead of managing a second set of keys, which removes the dual-authentication step from client configuration.
Read the guideIdentity Assertion Authorization Grants let an IdP such as Okta authorize 1 app's agent to reach another app's MCP server, with single-use grants and signed, audience-bound access tokens. Verified against the xaa.dev reference implementation. Experimental
Read the guideA governed inventory of every AI asset the gateway sees (providers, models, MCP tools, A2A agents, skills) that auto-flags anything observed but never sanctioned, with 15-minute auto-sync and live WebSocket alerts.
Read the guideMove an asset to quarantined or denied and it is blocked at the proxy on its next request, whether that is an MCP tool, an LLM model, or an entire provider, via a live denylist.
Publish a standards-compliant /.well-known/ai-catalog.json and answer "what is available for this task?" through search, explore, and federation. It is the discovery layer in front of A2A, MCP, and skills.
Auto-discover agents via AgentCard URLs, invoke them with streaming responses, and track stateful tasks through their lifecycle. Built on the a2a-go v2 SDK with native spec v1.0 support, and every call is scored by the policy engine.
Read the guideA full MCP server that assistants connect to directly. Submit skill source for content-addressable approval, where any change resets the skill to pending, and report suspicious runtime behaviour back to the gateway.
Read the guide3 MCP servers ship inside the gateway over Streamable HTTP: proxy discovery, ARD discovery, and the Skill Security Hub. All 3 answer modern 2026-07-28 clients and legacy 2024-11-05 clients alike.
Read the guideCompose registered A2A agents and MCP tools into multi-step flows that run behind the same policy engine, attribution, and audit trail as every other request.
Read the guideMonthly USD limits per team or per API key with configurable warning thresholds. Choose to warn or hard-block at the limit, where exceeded requests receive an HTTP 402 and stop costing you money immediately.
Read the guideInput and output tokens, cost, and usage patterns tracked per proxy, per model, and per key, surfaced in the AI Usage Metrics dashboard so spend is attributable rather than aggregate.
Read the guideA live dashboard of request rates, error rates, and security alerts pushed over WebSocket with no polling, plus a security timeline, theme-aware charts, and a full alert status workflow.
Read the guideSend LLM traces to Langfuse, expose native Prometheus metrics, visualize in Grafana, and emit OpenTelemetry and Jaeger spans with p50, p95, and p99 percentiles.
Read the guideA user activity dashboard tying every request, alert, and blocked call back to the person and the verified agent behind it, across MCP servers and LLM APIs alike.
Read the guideAuth events, authorization failures, data changes, config changes, privileged admin actions, and security events are all logged and browsable in-dashboard, built for SOC 2, ISO 27001, HIPAA, and GDPR evidence.
Read the guideRun unlimited MCP and LLM proxy instances side by side. Create, configure, start, stop, and restart each from 1 dashboard over HTTP, WebSocket, or SSE, with port conflicts caught at edit time.
Read the guideProxy servers on the 2026-07-28 MCP spec and the 2024-11-05 spec side by side. A compatibility bridge lets modern clients reach legacy servers, every downgrade is alerted rather than silent, and deprecated feature use is reported before it breaks.
Read the guideA Vue 3 dashboard with real-time status, an interactive alerts view, a visual policy editor, usage analytics, and full light and dark theming, responsive on desktop and mobile.
Read the guideBuilt-in walkthroughs for the proxy and settings screens, so a new operator can be productive without reading the manual first.
Read the guideOne pre-built Go binary for Linux, macOS, and Windows, with no Docker required for the API server and no runtime to install. Configuration, alerts, and logs persist to SQLite via GORM.
Read the guideA shared upstream transport with configurable response-header timeouts and per-proxy circuit breakers, so 1 failing provider cannot take the rest of your traffic down with it.
Read the guideReplicate audit logs, alerts, and token usage to an external RDS database (PostgreSQL or MySQL) for long-term retention, via real-time, batch, or hybrid sync.
Read the guideSchedule database snapshots from hourly to weekly with compression and a retention cap, browse every backup, and restore in 1 click from the Settings dashboard.
Read the guideThanks to OAuth DCR and well-known discovery endpoints, MCP clients like Cursor IDE and Claude Desktop authenticate and start working without manual configuration.
Read the guideNo capabilities match that search.
Setup walkthroughs, worked scenarios, and day-to-day operation for the capabilities above.
One binary, no licence key, no usage limits. Download it and point a client at it.
