API Security Built for Developers
Drop in G8KEPR and get SQL injection protection, rate limiting, JWT validation, and ML detection across 24 attack categories (94,000+ training samples) blocked automatically. No security expertise required.
Security that gets out of your way so you can focus on building
Every API you ship is a potential attack surface. But you shouldn't need a security degree to protect it. G8KEPR gives you enterprise-grade security that works out of the box.
POST /api/usersSQL injection blockedJWT verified automatically1000 req/min defaultYour API is live. Users are signing up. And attackers are probing every endpoint. Here's what they're trying:
Run the collector with Docker Compose or Helm, then call its API from an SDK
ML detection across 24 attack categories (94,000+ training samples) blocked out of the box — zero configuration
GET /api/users?id=1; DROP TABLE users;--POST /api/comments body: {text: "<script>..."}GET /api/admin -H "Authorization: Bearer [tampered]"POST /api/login (10,000 attempts, brute force)Security that integrates with how you already build
SQL injection, XSS, CSRF, and ML detection across 24 attack categories (94,000+ training samples) blocked automatically. No rules to write. No policies to configure.
ML detector · 94,000+ samplesPython, TypeScript and Go clients for the G8KEPR REST API: threat records, compliance status, audit log export, API keys and reports. Framework-agnostic, because they call the API rather than wrap your app.
Python · TypeScript · GoPoint G8KEPR at your OpenAPI spec. Auto-generate security policies, validate schemas, and document coverage.
Swagger 3.0 supportTest in production without blocking traffic. Shadow mode logs threats and validates policies without enforcement.
Zero-risk testingIntelligent defaults that protect your API from abuse without blocking legitimate users. Per-IP, per-key, per-endpoint.
Adaptive thresholdsBuilding AI features? Route LLM requests through G8KEPR for cost tracking, automatic failover, and unified billing.
Claude, GPT-4, GeminiSame protection on every endpoint, MCP tool call, and LLM proxy. Per-request platform overhead measured 12.38 ms at the median (p50) on the production node: one client, through authentication. That is not detection time.
Not in Anthropic's MCP spec. Not in API gateways. Not in WAFs. Platform-level additions built into the G8KEPR gateway and MCP proxy.
MCP servers the proxy launches locally (stdio, off unless the operator sets MCP_STDIO_SERVERS_ENABLED) run in their own session (setsid), drop to nobody if started as root, and get no-new-privs, ambient capabilities cleared and RLIMIT_AS/FSIZE/NOFILE/NPROC ceilings. Remote (HTTP) servers are proxied and inspected, not sandboxed, and network egress is not filtered.
SHA-256 hash of every tool definition pinned at tools/list. On every tools/call, the cached definition is re-hashed and compared. Drift raises MCPRugPullDetectedError, blocks execution, publishes a CRITICAL event.
Statistical, not threshold-based. Z-score > 3.0 against per-hour time-of-day baselines. 4 overlapping sliding windows (1m/5m/15m/1h). Progressive recovery (10→25→50→100%).
Findings from all four pillars land on one threat-event bus. A compound correlator groups them in 5-minute windows by correlation ID and by organization + client IP, and raises one incident when they match a known multi-stage pattern: a prompt injection at the gateway plus an SSRF probe and a path traversal at the API from the same client become a single critical Lethal Trifecta finding.
HMAC-SHA256 hash chain on authentication and domain events (since 2026-09-13), each entry signing the previous. Three verification levels (full / single / last-N). Audit records are exportable for SOC 2 audit observation, customer attestations, and incident forensics.
Cross-session attack detection: 6-dimension risk score (max 110) across tool sensitivity, data volume, burst, denials, prior detections, and tool diversity. Catches coordinated attacks and 24h slow-and-low patterns.
Every pillar publishes its findings to one threat event bus. The compound correlator joins findings on the same request by correlation ID, and separate requests from one client by organization + client IP.
mcp_tool_calls with its correlation ID • Compound findings link every contributing findingThree SDKs for the REST API. Any other language can call the API directly.
Your customers ask for SOC 2 evidence, you have it. Control crosswalk: each SOC 2 control is mapped to its overlapping ISO 27001 and NIST 800-53 controls, so one set of evidence can be reused.
"-Ready" / "aligned" reflect capability posture. SOC 2 Type II observation in progress with external audit H2 2026. PCI DSS certification requires a Qualified Security Assessor (QSA) engagement on the customer's side.
Common questions from developers getting started
Need help getting started?
Read the full documentation →Free hosted Community tier with 100K findings a month. No credit card required.
Community is free forever and hosted only • Self-hosting starts at Business • Free 30-day trial — extend to 90 days free, no card required