Ai Security Gateway

AI Security Gateway

[](https://github.com/syphon1c/ai-security-gateway/releases) [](https://opensource.org/licenses/MIT)

> 🚀 First Full Release - A security gateway and monitoring platform for LLM APIs, Model Context Protocol (MCP) servers and Agent-to-Agent (A2A) Registry. Free and self-hosted.

What is the AI Security Gateway?

The AI Security Gateway is a unified security platform that provides real-time monitoring, policy enforcement, and threat detection and a number of new security controls for Large Language Model (LLM) APIs, Model Context Protocol (MCP) servers and Agent-to-Agent (A2A). It acts as an intelligent proxy layer between your applications and AI services and tooling, giving you complete visibility and security control over AI interactions and automations.

Think of it as a security gateway for your AI infrastructure - monitoring every request, applying various security policies, tracking usage, and ensuring compliance with your organization's security requirements. It started as a personal project for my own testing and needs; it has grown a lot and is now ready for more users.

Getting started document can be found at AI Security Gateway Docs and there is a new AI Security Gateway Website

✅ Release Notice

v2026.8.1 is the first full (non-beta) release of the AI Security Gateway, following seven public betas. This release focused on enterprise readiness: a whole-platform security review, authentication and session hardening, stability and race-condition fixes across the proxy data path, and a documentation overhaul.

• Report bugs and provide feedback via GitHub Issues
• Review the [CHANGELOG.md](CHANGELOG.md) for complete feature details
• Community feedback is welcomed to help improve the software

Upgrading from a beta release?

• Release packages no longer include a pre-created .env. Run ./install.sh (or copy env.example to .env and set your keys). The gateway now refuses to start on missing, default, or template placeholder values for JWT_SECRET / ENCRYPTION_KEY
• Existing sessions are invalidated on upgrade; users must sign in again
• All new controls are opt-in; existing proxy configurations continue to behave as before

✨ What's New in v2026.8.1

Where the beta series focused on new capability, this release focuses on enterprise readiness, plus two protocol upgrades:

• 🔌 MCP 2026-07-28 Protocol Support - the gateway speaks both eras of the Model Context Protocol side by side: era-aware enforcement (never guessed), per-proxy conformance mode (enforce or observe), a compatibility bridge so modern clients can reach legacy servers (downgrades always alerted), event-by-event SSE-over-POST inspection, and new-surface protections: credential-phishing detection in elicitation results, tool schema safety analysis, protocol extension deny-lists, and minimum-version pinning
• 🔁 Cross App Access (XAA) Conformance - verified against draft-ietf-oauth-identity-assertion-authz-grant-04 and the xaa.dev reference implementation; the exchange now mints signed at+jwt access tokens accepted end-to-end, with single-use grants, step-up authentication (RFC 9470), and discovery-based JWKS
• 🔐 Authentication & Session Hardening - server-side logout revocation, immediate session invalidation on role change or account disable, a session management UI, login rate limits with a timing-oracle fix, forced password rotation, and hard startup failure on missing/default/placeholder secrets
• 🛡️ Whole-Platform Security Review - fail-closed policy loading and permission checks, SSRF guards on every outbound fetch, guardrail and connector credentials encrypted at rest and masked in responses, and complete audit coverage of privileged actions
• 🪪 Agent Identity Hardening - did:key identities must be registered before they verify, full DPoP proof verification (RFC 9449), identity headers stripped before forwarding upstream, and per-proxy enforcement configurable in the UI
• 🧪 Detection Quality - an 85-case guardrails evaluation corpus plus custom test-case authoring with JSON import/export, canary cross-user leak detection, and migration to the A2A spec v1.0 SDK
• 📦 Versioned, Verifiable Builds - every binary reports its real version (./unified-admin --version), and release packages are verified end to end before publishing

See the [CHANGELOG.md](CHANGELOG.md) for the complete list.

🎯 Key Features

🔌 MCP 2026-07-28 Protocol Support

The gateway speaks both eras of the Model Context Protocol side by side: the modern 2026-07-28 specification and the legacy 2024-11-05 specification.

• Era-aware proxying: enforcement follows the protocol era each request declares, never a guess; the upstream's era is learned through a real server/discover probe
• Conformance enforcement: on modern requests, JSON-RPC batches are refused and the mirrored MCP-Protocol-Version / Mcp-* headers are validated against the body, with spec-correct protocol errors
• Enforce or observe: a per-proxy conformance mode lets you watch violations before you start blocking them
• Compatibility bridge: modern clients can reach legacy servers through a translation layer, and a bridged downgrade always raises an alert
• New-surface security: credential-phishing prompts inside elicitation results raise alerts, tool schemas are analysed for unsafe shapes, protocol extensions can be deny-listed, and a minimum protocol version can be pinned per proxy
• Tasks stay governed: tool permissions and rate limits follow MCP task handles, so a disabled tool cannot keep delivering results through an earlier task

🛡️ Cryptographic Agent Identity (SPIFFE / DID / X.509)

The gateway already records which human is behind a request (attribution); Agent Identity adds attestation, a verifiable cryptographic identity for the agent workload itself, proven on every request. So each action ties to both a person and a specific, verified agent (e.g. spiffe://acme.org/checkout-bot). The gateway is a verifier first (it validates identities issued by your SPIRE/IdP/DID infrastructure) and a CA never, except for an explicit, opt-in issuance mode.

• Three identity formats, one pipeline: SPIFFE JWT-SVIDs (header-borne), SPIFFE X.509-SVIDs (mTLS, or a forwarded client-cert header behind a trusted front proxy), and DIDs, did:key (key embedded in the identifier, registration-gated before it verifies) and did:web (resolved from admin-approved hosts, SSRF-guarded)
• Opt-in per proxy: off / optional (verify-and-attribute) / required (fail-closed 401); plus a global default and per-proxy allowed-trust-domain lists, all configurable in the proxy settings UI
• Identity-based enforcement: a deny-biased Agent dimension on the MCP tool-permission hierarchy (an agent rule can only further restrict the human decision, never escalate) and a per-proxy autonomy floor that rejects insufficiently-trusted agents
• Verifiable delegation chains: an X-Agent-Delegation-Chain of signed on-behalf-of hops, verified end-to-end with a confused-deputy guard, an unverified chain is never trusted
• Proof-of-possession & step-up: full DPoP proof verification (RFC 9449 - signature, thumbprint, request binding, freshness, single-use jti); a proxy can require proof-of-possession and answer bearer-only credentials with a WWW-Authenticate: DPoP step-up challenge
• Credentials stop at the gateway: on a verifying proxy, identity and DPoP headers are stripped before forwarding upstream
• A2A impersonation detection: bind an identity to a registered A2A agent and the card monitor flags any AgentCard not signed by the bound key (critical), complementing rug-pull field-diff detection
• Revocation that reaches live sessions: revoking an identity blocks it on the next request and tears down its in-flight A2A streams and SSE proxy connections within seconds
• Opt-in gateway issuance: when enabled, mint short-lived (DPoP-bindable) agent SVIDs, the signing key lives in memory only and rotates on restart, so the gateway never becomes a persistent CA
• Security-first: verifier by default, write-only key material, SSRF-guarded fetches, admin-gated mutations, and full audit logging
• Dashboard tile: active identities, verifications, and failures surfaced on the Security dashboard

🔍 Shadow-AI Discovery & AI Asset Inventory

A unified, governed inventory of every AI asset the gateway can see: LLM providers/models, MCP servers/tools, A2A agents, and skills, that automatically flags shadow AI: anything observed but never sanctioned. It's the inbound mirror of ARD: where ARD publishes what you advertise, the AI Inventory records what you actually observe, and turns that into a control point.

• Three observation planes: in-band (projects assets from gateway-proxied traffic, token usage + request audits, with zero added request latency), ingest (catches AI that bypasses the gateway entirely via a push endpoint and SSRF-guarded pull connectors for CASB/DNS/OTel/Langfuse egress logs), and active scanning (planned)
• Governance lifecycle: every asset carries a state, sanctioned, observed, unsanctioned (shadow), quarantined, or denied, with first-seen/last-seen tracking, risk scoring, and per-asset observation timelines
• Enforcement, not just reporting: moving an asset to quarantined or denied blocks it at the proxy (MCP tools, LLM models, or entire providers) via an in-memory denylist refreshed on every state change; a blocked provider blocks all of its models
• Opt-in auto-quarantine: newly-discovered shadow AI can be automatically quarantined and blocked on its very next request (off by default, observe-only posture)
• Provider fingerprint catalog: built-in signatures for OpenAI, Anthropic, Google Gemini, AWS Bedrock, Azure OpenAI, Cohere, Mistral, and more, plus custom host/regex/path/model fingerprints so self-hosted and internal AI is classified correctly
• Shadow-AI alerts: raises a security alert the first time an unsanctioned asset is discovered, with full attribution (user, host, source)
• Security-first: observe-only by default, observations store fingerprints/hosts/model names only (never raw payloads), SSRF protection on all connector fetches, admin-only mutations, and full audit logging
• Dashboard tile: total assets, shadow count, and blocked count surfaced on the Security dashboard

🧭 Agentic Resource Discovery (ARD)

Turn the gateway into a discovery service for agentic resources using the open Agentic Resource Discovery standard. ARD sits before invocation, it lets an AI client ask "what's available for this task?" and answers with matching A2A agents, MCP servers, and skills, which are then called through their own native protocols. It does not replace A2A, MCP, or Skills; it's the discovery layer in front of them.

• Publishes your catalog: Serves a standards-compliant /.well-known/ai-catalog.json AI Catalog manifest describing your agentic resources
• Auto-projection: Automatically projects your public A2A agents, public MCP proxies/tools, and approved skills into the catalog, no separate source of truth to maintain
• Registry search API: Exposes POST /search (natural-language query with 0–100 relevance scoring), POST /explore (facet aggregation), and GET /agents (deterministic browsing) for any ARD-compliant client
• Federation: Query trusted upstream registries with referrals (return pointers) or auto (merge results) modes, with SSRF protection, trust gating, and de-duplication
• Native MCP discovery: AI assistants connect to a built-in MCP server (/api/v1/mcp/ard) exposing ard_search and ard_explore tools to discover capabilities on the fly, instead of hard-coding every tool into the context window
• A2A skill: The gateway's AgentCard advertises a resource-discovery skill so A2A orchestrators can find this capability
• Security-first: Opt-in publishing (disabled by default), access-restricted resources excluded, domain-anchored URN/identity binding, upstream trust verification, rate limiting, and full audit logging
• Standards-only: Only spec-blessed media types (A2A agent cards, MCP server cards, AI skills, registries, catalogs), no proprietary extensions
• Dashboard tile: Catalog and federation status surfaced in the Security dashboard

🚦 Per-Tool & Per-User Rate Limiting

Rate limiting is enforced at finer granularity, in addition to the existing proxy-level controls:

• Per-tool limits: sliding-window rate limits applied per MCP tool, keyed by user · proxy · tool (0 = unlimited)
• Per-user limits: proxy-wide sliding-window limits keyed by user · proxy
• Hierarchy-aware: per-tool limits resolve through the User override → Group → Global proxy-setting hierarchy alongside the enable/disable decision for each tool

💰 Budget Limits & Cost Control

Control spending and manage costs across teams and API keys:

• Monthly Budget Limits: Set spending limits per user group/team in USD
• Configurable Warning Thresholds: Alert when spending reaches a percentage of budget (e.g., 80%)
• Flexible Enforcement: Choose to block requests at threshold or just warn (allows continued access with warnings)
• Automatic Monthly Reset: Budgets automatically reset at the start of each calendar month
• Manual Reset: Reset budgets manually via API or web interface when needed
• Real-Time Tracking: Monitor current month spending, budget utilization, and remaining budget
• Dashboard Metrics: View budget status across all teams in the AI Usage Metrics dashboard
• Request Blocking: Automatic blocking when budget is exceeded (HTTP 402 Payment Required)

🔄 Multi-Proxy Management

Run and manage multiple MCP and LLM proxy instances simultaneously through an intuitive web interface:

• Create, configure, start, stop, and restart proxies with a few clicks
• Support for HTTP, WebSocket, and Server-Sent Events (SSE) transport protocols
• Centralized dashboard showing real-time status of all proxy instances
• Database-backed persistence for configurations, alerts, and audit logs
• Per-proxy health monitoring and performance metrics

🛡️ Custom Security Policies (Guardrails)

Apply granular security policies to individual proxies or groups:

• 250+ built-in default detection rules across critical, high, medium, and low severity levels
• JSON-based policy configuration for easy customization
• Real-time threat detection and blocking (SQL injection, command injection, path traversal, Prompt Injection, Jailbreaking etc.)
• Data Redaction & Unmasking: Redact sensitive data sent to LLMs with automatic unmasking of responses - mask PII, secrets, and sensitive content before sending to providers, then automatically restore original values in responses for seamless user experience
• APAC PII Localization: Detection and masking for Asia-Pacific national identifiers - Taiwan National ID/ARC, Japan My Number, PRC Resident ID, South Korea RRN, Singapore NRIC/FIN, Hong Kong HKID, Australia TFN/Medicare, and India Aadhaar - with CJK context labels and full-width digit support. Numeric identifiers are checksum-validated (Luhn, Verhoeff, and per-country algorithms) so lookalike numbers such as order IDs and timestamps are not falsely masked
• Policy templates: llm-critical-security, llm-standard-security, mcp-advanced-security, mcp-encoding-detection-security.json, llm-compliance-gdpr.json, llm-compliance-apac.json and more...
• Per-proxy policy assignment - different security le

…

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: syphon1c
• Source: syphon1c/ai-security-gateway
• License: MIT
• Homepage: https://aisecgateway.com/

Install and usage instructions live in the source repository linked above.