What G8KEPR does not do

On a fresh install from the quick start, about thirty distinct controls refuse a request: body-size limits, an identity check on every route, four layers of rate limiting, a WAF with nine built-in block rules, CSRF protection, and the AI gateway and MCP checks marked ENFORCING on the homepage. The MCP tool-call path is default-deny.

Much of the rest is advisory by design, and some controls that can block ship switched off. Threat-detection blocking is off in the shipped configuration, and the gateway guardrail policies log rather than block. You decide, control by control, what enforces in your deployment.

On a 2,580-sample held-out set it was never trained on, the detector catches 78.8% of attacks (recall 0.788), is right 85.7% of the time when it flags something (precision 0.857), and flags 3.12% of the benign prompts. About one attack in five gets past the detector on its own. The enforcing controls listed above do not rely on it.

On the production node, per-request platform overhead measured 12.38 ms at the median (p50): one client sending requests in sequence through the middleware stack up to and including authentication. That is not detection time, and not latency under concurrent load, which has not been measured yet.

Output-side scanning covers non-streamed responses. Streamed completions skip most of it.

Grounding verification runs only when a request supplies the sources the answer is supposed to rest on. Without sources there is nothing to check the answer against, so it does not run.

When it runs, it checks the claims it can extract: figures, dates, URLs, citations, API and tool references, and statements introduced by phrases such as "according to". When the fine-tuned grounding model is installed and the opt-in fusion mode is off, the other sentences are checked too, one at a time in order until a time budget runs out (5 seconds by default), and a plain prose sentence counts as a claim when that model finds the sources contradict it. Sentences past the budget are not checked and do not fail the response; the result only notes them in its errors, so a long response, or a false sentence placed after enough harmless ones, can pass. Measured end to end, that catches about 57% of false prose sentences, and it flags about 6% of correct sentences, 13% of sentences the sources do not mention, and 16% of responses made of four correct claims; each extra sentence is another chance of a false flag, so the per-response rate grows with length. Without that model, or with the fusion mode on, plain prose is not checked. Verdicts come from a trained classifier over an NLI model that is downloaded from HuggingFace on first use; without it, grounding falls back to keyword overlap, which does not catch a changed figure. Every grounding result states which of the two decided.

Every pillar publishes its findings to one internal threat event bus, and a correlator scores findings that occur together. It joins findings that share a correlation ID, which in practice means findings raised on the same request, and findings from the same client IP within an organization inside a 5-minute window.

The cross-request join is by client IP, not by user: one user arriving from several IPs is not joined, and clients behind one shared NAT address are not told apart.

G8KEPR is self-hosted in your own VPC. You operate the PostgreSQL database, Redis, backups and upgrades, and the backend image carries a CPU build of PyTorch for the ML detector, so it needs real memory.

Plan for the same operational work as any other stateful service you run.