# Ai Security Gateway > The AI Security Gateway is a security platform that provides real-time monitoring, policy enforcement, and threat detection for Large Language Model (LLM) APIs and Model Context Protocol (MCP) servers. It acts as an intelligent proxy layer between your applications and AI services, giving you complete visibility and control over AI interactions. - **Type:** MCP server - **Install:** `agentstack add mcp-syphon1c-ai-security-gateway` - **Verified:** Yes โ€” security-reviewed for prompt injection and unsafe behavior - **Seller:** [syphon1c](https://agentstack.voostack.com/s/syphon1c) - **Installs:** 0 - **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml) - **Latest version:** 0.1.0 - **License:** MIT - **Upstream author:** [syphon1c](https://github.com/syphon1c) - **Source:** https://github.com/syphon1c/ai-security-gateway - **Website:** https://aisecgateway.com/ ## Install ```sh agentstack add mcp-syphon1c-ai-security-gateway ``` Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent. ## About # AI Security Gateway [](https://github.com/syphon1c/ai-security-gateway/releases) [](https://opensource.org/licenses/MIT) > **๐Ÿš€ First Full Release** - A security gateway and monitoring platform for LLM APIs, Model Context Protocol (MCP) servers and Agent-to-Agent (A2A) Registry. Free and self-hosted. ## What is the AI Security Gateway? The **AI Security Gateway** is a unified security platform that provides **real-time monitoring**, **policy enforcement**, and **threat detection** and a number of **new security controls** for Large Language Model (LLM) APIs, Model Context Protocol (MCP) servers and Agent-to-Agent (A2A). It acts as an intelligent proxy layer between your applications and AI services and tooling, giving you complete visibility and security control over AI interactions and automations. Think of it as a **security gateway** for your AI infrastructure - monitoring every request, applying various security policies, tracking usage, and ensuring compliance with your organization's security requirements. It started as a personal project for my own testing and needs; it has grown a lot and is now ready for more users. Getting started document can be found at [AI Security Gateway Docs](https://docs.aisecgateway.com/) and there is a new [AI Security Gateway Website](https://aisecgateway.com/) ## โœ… Release Notice **v2026.8.1** is the **first full (non-beta) release** of the AI Security Gateway, following seven public betas. This release focused on enterprise readiness: a whole-platform security review, authentication and session hardening, stability and race-condition fixes across the proxy data path, and a documentation overhaul. - **Report bugs** and provide feedback via [GitHub Issues](https://github.com/syphon1c/ai-security-gateway/issues) - **Review the [CHANGELOG.md](CHANGELOG.md)** for complete feature details - **Community feedback** is welcomed to help improve the software ### Upgrading from a beta release? - Release packages **no longer include a pre-created `.env`**. Run `./install.sh` (or copy `env.example` to `.env` and set your keys). The gateway now **refuses to start** on missing, default, or template placeholder values for `JWT_SECRET` / `ENCRYPTION_KEY` - Existing sessions are invalidated on upgrade; users must sign in again - All new controls are **opt-in**; existing proxy configurations continue to behave as before ## โœจ What's New in v2026.8.1 Where the beta series focused on new capability, this release focuses on **enterprise readiness**, plus two protocol upgrades: - **๐Ÿ”Œ MCP 2026-07-28 Protocol Support** - the gateway speaks both eras of the Model Context Protocol side by side: era-aware enforcement (never guessed), per-proxy conformance mode (enforce or observe), a compatibility bridge so modern clients can reach legacy servers (downgrades always alerted), event-by-event SSE-over-POST inspection, and new-surface protections: credential-phishing detection in elicitation results, tool schema safety analysis, protocol extension deny-lists, and minimum-version pinning - **๐Ÿ” Cross App Access (XAA) Conformance** - verified against `draft-ietf-oauth-identity-assertion-authz-grant-04` and the xaa.dev reference implementation; the exchange now mints signed `at+jwt` access tokens accepted end-to-end, with single-use grants, step-up authentication (RFC 9470), and discovery-based JWKS - **๐Ÿ” Authentication & Session Hardening** - server-side logout revocation, immediate session invalidation on role change or account disable, a session management UI, login rate limits with a timing-oracle fix, forced password rotation, and hard startup failure on missing/default/placeholder secrets - **๐Ÿ›ก๏ธ Whole-Platform Security Review** - fail-closed policy loading and permission checks, SSRF guards on every outbound fetch, guardrail and connector credentials encrypted at rest and masked in responses, and complete audit coverage of privileged actions - **๐Ÿชช Agent Identity Hardening** - `did:key` identities must be registered before they verify, full DPoP proof verification (RFC 9449), identity headers stripped before forwarding upstream, and per-proxy enforcement configurable in the UI - **๐Ÿงช Detection Quality** - an 85-case guardrails evaluation corpus plus custom test-case authoring with JSON import/export, canary cross-user leak detection, and migration to the A2A spec v1.0 SDK - **๐Ÿ“ฆ Versioned, Verifiable Builds** - every binary reports its real version (`./unified-admin --version`), and release packages are verified end to end before publishing See the [CHANGELOG.md](CHANGELOG.md) for the complete list. ## ๐ŸŽฏ Key Features ### ๐Ÿ”Œ MCP 2026-07-28 Protocol Support The gateway speaks both eras of the Model Context Protocol side by side: the modern **2026-07-28** specification and the legacy **2024-11-05** specification. - **Era-aware proxying**: enforcement follows the protocol era each request *declares*, never a guess; the upstream's era is learned through a real `server/discover` probe - **Conformance enforcement**: on modern requests, JSON-RPC batches are refused and the mirrored `MCP-Protocol-Version` / `Mcp-*` headers are validated against the body, with spec-correct protocol errors - **Enforce or observe**: a per-proxy conformance mode lets you watch violations before you start blocking them - **Compatibility bridge**: modern clients can reach legacy servers through a translation layer, and a bridged downgrade always raises an alert - **New-surface security**: credential-phishing prompts inside elicitation results raise alerts, tool schemas are analysed for unsafe shapes, protocol extensions can be deny-listed, and a minimum protocol version can be pinned per proxy - **Tasks stay governed**: tool permissions and rate limits follow MCP task handles, so a disabled tool cannot keep delivering results through an earlier task ### ๐Ÿ›ก๏ธ Cryptographic Agent Identity (SPIFFE / DID / X.509) The gateway already records **which human** is behind a request (attribution); Agent Identity adds **attestation**, a verifiable cryptographic identity for the **agent workload itself**, proven on every request. So each action ties to *both* a person *and* a specific, verified agent (e.g. `spiffe://acme.org/checkout-bot`). The gateway is a **verifier first** (it validates identities issued by your SPIRE/IdP/DID infrastructure) and a CA never, except for an explicit, opt-in issuance mode. - **Three identity formats, one pipeline**: SPIFFE **JWT-SVIDs** (header-borne), SPIFFE **X.509-SVIDs** (mTLS, or a forwarded client-cert header behind a trusted front proxy), and **DIDs**, `did:key` (key embedded in the identifier, registration-gated before it verifies) and `did:web` (resolved from admin-approved hosts, SSRF-guarded) - **Opt-in per proxy**: `off` / `optional` (verify-and-attribute) / `required` (fail-closed `401`); plus a global default and per-proxy allowed-trust-domain lists, all configurable in the proxy settings UI - **Identity-based enforcement**: a **deny-biased** Agent dimension on the MCP tool-permission hierarchy (an agent rule can only *further restrict* the human decision, never escalate) and a per-proxy **autonomy floor** that rejects insufficiently-trusted agents - **Verifiable delegation chains**: an `X-Agent-Delegation-Chain` of signed on-behalf-of hops, verified end-to-end with a confused-deputy guard, an unverified chain is never trusted - **Proof-of-possession & step-up**: full DPoP proof verification (RFC 9449 - signature, thumbprint, request binding, freshness, single-use `jti`); a proxy can **require** proof-of-possession and answer bearer-only credentials with a `WWW-Authenticate: DPoP` step-up challenge - **Credentials stop at the gateway**: on a verifying proxy, identity and DPoP headers are stripped before forwarding upstream - **A2A impersonation detection**: bind an identity to a registered A2A agent and the card monitor flags any AgentCard not signed by the bound key (critical), complementing rug-pull field-diff detection - **Revocation that reaches live sessions**: revoking an identity blocks it on the next request **and** tears down its in-flight A2A streams and SSE proxy connections within seconds - **Opt-in gateway issuance**: when enabled, mint short-lived (DPoP-bindable) agent SVIDs, the signing key lives in memory only and rotates on restart, so the gateway never becomes a persistent CA - **Security-first**: verifier by default, write-only key material, SSRF-guarded fetches, admin-gated mutations, and full audit logging - **Dashboard tile**: active identities, verifications, and failures surfaced on the Security dashboard ### ๐Ÿ” Shadow-AI Discovery & AI Asset Inventory A unified, governed **inventory of every AI asset the gateway can see**: LLM providers/models, MCP servers/tools, A2A agents, and skills, that automatically flags **shadow AI**: anything observed but never sanctioned. It's the inbound mirror of ARD: where ARD publishes what you *advertise*, the AI Inventory records what you actually *observe*, and turns that into a control point. - **Three observation planes**: *in-band* (projects assets from gateway-proxied traffic, token usage + request audits, with zero added request latency), *ingest* (catches AI that **bypasses** the gateway entirely via a push endpoint and SSRF-guarded pull connectors for CASB/DNS/OTel/Langfuse egress logs), and *active scanning* (planned) - **Governance lifecycle**: every asset carries a state, `sanctioned`, `observed`, `unsanctioned` (shadow), `quarantined`, or `denied`, with first-seen/last-seen tracking, risk scoring, and per-asset observation timelines - **Enforcement, not just reporting**: moving an asset to `quarantined` or `denied` **blocks it at the proxy** (MCP tools, LLM models, or entire providers) via an in-memory denylist refreshed on every state change; a blocked provider blocks all of its models - **Opt-in auto-quarantine**: newly-discovered shadow AI can be automatically quarantined and blocked on its very next request (off by default, observe-only posture) - **Provider fingerprint catalog**: built-in signatures for OpenAI, Anthropic, Google Gemini, AWS Bedrock, Azure OpenAI, Cohere, Mistral, and more, plus custom host/regex/path/model fingerprints so self-hosted and internal AI is classified correctly - **Shadow-AI alerts**: raises a security alert the first time an unsanctioned asset is discovered, with full attribution (user, host, source) - **Security-first**: observe-only by default, observations store fingerprints/hosts/model names only (never raw payloads), SSRF protection on all connector fetches, admin-only mutations, and full audit logging - **Dashboard tile**: total assets, shadow count, and blocked count surfaced on the Security dashboard ### ๐Ÿงญ Agentic Resource Discovery (ARD) Turn the gateway into a **discovery service for agentic resources** using the open [Agentic Resource Discovery](https://agenticresourcediscovery.org/) standard. ARD sits *before* invocation, it lets an AI client ask "what's available for this task?" and answers with matching A2A agents, MCP servers, and skills, which are then called through their own native protocols. It does not replace A2A, MCP, or Skills; it's the discovery layer in front of them. - **Publishes your catalog**: Serves a standards-compliant `/.well-known/ai-catalog.json` AI Catalog manifest describing your agentic resources - **Auto-projection**: Automatically projects your public A2A agents, public MCP proxies/tools, and approved skills into the catalog, no separate source of truth to maintain - **Registry search API**: Exposes `POST /search` (natural-language query with 0โ€“100 relevance scoring), `POST /explore` (facet aggregation), and `GET /agents` (deterministic browsing) for any ARD-compliant client - **Federation**: Query trusted upstream registries with `referrals` (return pointers) or `auto` (merge results) modes, with SSRF protection, trust gating, and de-duplication - **Native MCP discovery**: AI assistants connect to a built-in MCP server (`/api/v1/mcp/ard`) exposing `ard_search` and `ard_explore` tools to discover capabilities on the fly, instead of hard-coding every tool into the context window - **A2A skill**: The gateway's AgentCard advertises a `resource-discovery` skill so A2A orchestrators can find this capability - **Security-first**: Opt-in publishing (disabled by default), access-restricted resources excluded, domain-anchored URN/identity binding, upstream trust verification, rate limiting, and full audit logging - **Standards-only**: Only spec-blessed media types (A2A agent cards, MCP server cards, AI skills, registries, catalogs), no proprietary extensions - **Dashboard tile**: Catalog and federation status surfaced in the Security dashboard ### ๐Ÿšฆ Per-Tool & Per-User Rate Limiting Rate limiting is enforced at finer granularity, in addition to the existing proxy-level controls: - **Per-tool limits**: sliding-window rate limits applied per MCP tool, keyed by user ยท proxy ยท tool (`0` = unlimited) - **Per-user limits**: proxy-wide sliding-window limits keyed by user ยท proxy - **Hierarchy-aware**: per-tool limits resolve through the User override โ†’ Group โ†’ Global proxy-setting hierarchy alongside the enable/disable decision for each tool ### ๐Ÿ’ฐ Budget Limits & Cost Control Control spending and manage costs across teams and API keys: - **Monthly Budget Limits**: Set spending limits per user group/team in USD - **Configurable Warning Thresholds**: Alert when spending reaches a percentage of budget (e.g., 80%) - **Flexible Enforcement**: Choose to block requests at threshold or just warn (allows continued access with warnings) - **Automatic Monthly Reset**: Budgets automatically reset at the start of each calendar month - **Manual Reset**: Reset budgets manually via API or web interface when needed - **Real-Time Tracking**: Monitor current month spending, budget utilization, and remaining budget - **Dashboard Metrics**: View budget status across all teams in the AI Usage Metrics dashboard - **Request Blocking**: Automatic blocking when budget is exceeded (HTTP 402 Payment Required) ### ๐Ÿ”„ Multi-Proxy Management Run and manage **multiple MCP and LLM proxy instances** simultaneously through an intuitive web interface: - Create, configure, start, stop, and restart proxies with a few clicks - Support for HTTP, WebSocket, and Server-Sent Events (SSE) transport protocols - Centralized dashboard showing real-time status of all proxy instances - Database-backed persistence for configurations, alerts, and audit logs - Per-proxy health monitoring and performance metrics ### ๐Ÿ›ก๏ธ Custom Security Policies (Guardrails) Apply **granular security policies** to individual proxies or groups: - **250+ built-in default detection rules** across critical, high, medium, and low severity levels - JSON-based policy configuration for easy customization - Real-time threat detection and blocking (SQL injection, command injection, path traversal, Prompt Injection, Jailbreaking etc.) - **Data Redaction & Unmasking**: Redact sensitive data sent to LLMs with automatic unmasking of responses - mask PII, secrets, and sensitive content before sending to providers, then automatically restore original values in responses for seamless user experience - **APAC PII Localization**: Detection and masking for Asia-Pacific national identifiers - Taiwan National ID/ARC, Japan My Number, PRC Resident ID, South Korea RRN, Singapore NRIC/FIN, Hong Kong HKID, Australia TFN/Medicare, and India Aadhaar - with CJK context labels and full-width digit support. Numeric identifiers are **checksum-validated** (Luhn, Verhoeff, and per-country algorithms) so lookalike numbers such as order IDs and timestamps are not falsely masked - Policy templates: `llm-critical-security`, `llm-standard-security`, `mcp-advanced-security`, `mcp-encoding-detection-security.json`, `llm-compliance-gdpr.json`, `llm-compliance-apac.json` and more... - Per-proxy policy assignment - different security le โ€ฆ ## Source & license This open-source MCP server is cataloged on AgentStack and links to its original source โ€” we do not rehost the code. - **Author:** [syphon1c](https://github.com/syphon1c) - **Source:** [syphon1c/ai-security-gateway](https://github.com/syphon1c/ai-security-gateway) - **License:** MIT - **Homepage:** https://aisecgateway.com/ Install and usage instructions live in the source repository linked above. ## Pricing - **Free** โ€” Free ## Security capabilities Automated source analysis of v0.1.0 โ€” what this tool can access: - **Network access:** yes - **Filesystem access:** no - **Shell / process execution:** no - **Environment & secrets:** yes - **Dynamic code execution:** no *"Yes" means the capability is present in the source โ€” more access means more to trust, not that it is unsafe.* ## Versions - **0.1.0** โ€” security scan: passed โ€” Imported from the upstream source. ## Links - Listing page: https://agentstack.voostack.com/l/mcp-syphon1c-ai-security-gateway - Seller: https://agentstack.voostack.com/s/syphon1c - Browse the marketplace: https://agentstack.voostack.com/browse --- Listed on AgentStack โ€” the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.