API Security · MCP Security · AI Gateway · Verification Engine — every pillar publishing to one finding bus.
Most stacks bolt four separate vendors together and lose the thread between them. G8KEPR is one platform with one finding bus — findings raised on the same request are joined by its correlation ID, and separate requests from the same client are joined by organization + client IP.
Everything you need to secure APIs and AI applications
Multi-tier detection · 94,000+ labeled attack samples · OWASP 10/10/10
A multi-tier detection pipeline (regex on every request; an ML classifier on the AI-gateway path; embeddings and NLI when their models load; LLM escalation off by default) with 0.788 recall and 0.857 precision on a 2,580-sample held-out set it was never trained on (3.12% false-positive rate).
7-step pipeline · default-deny · rug-pull detect
MCP security with SHA-256 rug-pull detection on every tool definition and a default-deny tool-call path.
14 providers · auto prompt caching · opt-in adaptive breaker
One API across 14 providers (incl. BYOI custom). Auto-injects Anthropic prompt caching for 88% savings at 10 calls. Adaptive Z-score circuit breaker (opt-in). BYOK with AES-256-GCM.
4 layers · BLOCK-capable · SUGGEST action
Most AI guardrails detect-and-alert after bad output ships. G8KEPR is BLOCK-capable at middleware position 14 — four independent layers, six explicit failure modes, and a SUGGEST action that returns a compliant alternative instead of just an error.
Plugin marketplace for extending G8KEPR with community-contributed integrations — not yet shipped. The four pillars above are live today.
Every pillar publishes its findings to one threat event bus. The compound correlator joins findings on the same request by correlation ID, and separate requests from one client by organization + client IP, so a multi-stage attack that crosses pillars becomes one incident.
Four capabilities in the platform, each marked with what it does on a default install.
Rug-pull detection. Tool definitions hashed at tools/list time, re-verified on every tools/call. Mid-session mutation blocked with a CRITICAL event.
modules/mcp/tool_registry.pyStatistical baselines per provider per hour-of-day, not static thresholds. Progressive recovery 10/25/50/100%. Off by default; enable with ADAPTIVE_CB_ENABLED.
gateway/router.pyAll four pillars publish findings to one internal threat event bus, and a correlator scores the ones that occur together into incidents. It joins findings that share a correlation ID (the same request) or come from the same client IP within an organization (separate requests).
modules/compound_correlator/Security events are written to an append-only audit table. Authentication and domain events are HMAC-SHA256 hash-chained per tenant (full, single, last-N verification) and verified daily since 2026-09-13. Mapped to SOC 2 CC7.2, HIPAA §164.312(b), FedRAMP AU-9 (a mapping, not an attestation).
HMAC-SHA256 chain (auth + domain events)Common questions about the G8KEPR platform
Need help choosing the right features?
Talk to our solutions team →Every pillar writes per-request evidence to an append-only audit log. Control mappings are pre-built for the 14 frameworks listed above — a broader set than the 12 with assessment engines (which score measurable controls from platform evidence). Subject to independent audit and attestation — G8KEPR provides the technical controls and evidence; your auditor issues the certification.
Four pillars, one finding bus, hash-chain audit, and 2,000+ mapped controls across 14 compliance frameworks — without changing a line of your application code.
No credit card required • 30-day free trial (extend to 90 days free) • Cancel anytime