Block SQL injection, XSS, and 1,700+ attack patterns with AI threat detection
Pattern matching catches the cheap stuff in under 1 ms. Embeddings catch what regex misses. NLI catches what embeddings miss. LLM escalation catches what NLI misses. Behavioral baselines catch the rest. Every tier is CI-baseline-gated — a regression in recall or precision fails the build.
Understanding modern API threats and why traditional WAFs aren't enough
APIs are the backbone of modern applications. Every mobile app, SaaS platform, and microservice talks via APIs — and attackers know it. They target APIs to steal data, manipulate business logic, and gain unauthorized access faster than any other surface.
'; DROP TABLE users--Traditional WAFs rely on signature-based detection and regex patterns. They miss context-aware attacks, business-logic abuse, and the entire class of AI-specific threats — prompt injection, MCP tool abuse, jailbreaks, indirect injection. APIs in 2026 need semantic understanding, not pattern lists.
5-tier defense that understands your API's semantics and business logic, not just its bytes
POST /api/users/123/transfer { amount: 10000 }Intercept every API request before it reaches your backend
Block SQL, NoSQL, XSS, XXE, LDAP injection with pattern analysis and semantic validation.
✓ Pattern-based + semantic analysis detectionValidate JWT tokens, detect session hijacking, enforce MFA, prevent credential stuffing.
✓ Sub-1ms JWT validationPer-user, per-endpoint limits with burst allowance. Differentiate humans from bots.
✓ Designed for 1M+ RPSBehavioral analysis and anomaly detection identify zero-days, account takeovers, and unusual patterns.
✓ Catches unknown threatsFive capabilities that exist in the platform — not in a network-layer WAF, not in a regex-only proxy, not in any signature-database product.
Regex (<1ms) → SentenceTransformer embeddings → NLI zero-shot → LLM escalation → behavioral. Cheap tiers handle the bulk; expensive tiers reserved for the ambiguous.
modules/threat_detection/241-sample CI corpus enforces zero false positives and 87.96% recall. Any regression in detection quality fails the build automatically.
.github/threat-detection-baseline.jsonSpans web (SQLi, XSS, traversal), API (BOLA, auth, rate abuse), LLM (prompt injection, jailbreak, role hijack), and MCP (tool poisoning, redefinition, command injection).
Web · API · LLM · MCPBase64 decode-then-rescan · NFKC homoglyph normalize · l33tspeak reconstruction · prompt-wrap unwrap · zero-width strip · cross-request fragment correlation.
normalize · decode · stitchPassive traffic analysis flags endpoints not in the catalog. Risk-scored on auth, HTTPS, rate-limit, PII, traffic. Auto-blocks above threshold. FP ≤ 2% · FN ≤ 5%.
shadow_detector.pyMost WAFs ship a generic SQLi/XSS regex pack. G8KEPR's library spans the full modern attack surface — web, API, LLM, and MCP — and is versioned alongside the codebase.
Pattern matchers fall to encoding tricks. G8KEPR normalizes, decodes, and re-stitches before pattern matching, so the same payload can't slip through dressed differently.
The only API security platform built for modern AI applications
Only platform that secures APIs, AI agents, and MCP tools in one unified solution. Protect LLM applications from prompt injection, tool abuse, and context poisoning.
Targets sub-5ms routing overhead for cached requests (targets ~40ms p99 with full threat detection). Edge caching, parallel analysis, and optimized pattern matching. Deploy as proxy, sidecar, or library - your choice.
Real-time dashboards showing every attack, blocked request, and anomaly. Export logs to your SIEM. Generate compliance reports (SOC 2, HIPAA, PCI-DSS).
Everything you need to secure REST, GraphQL, and gRPC APIs
Full OWASP Top 10 (Web), OWASP API Security 2023, and OWASP LLM Top 10 2025 — all 30 controls covered. 200+ MITRE ATT&CK techniques mapped, including custom AI-specific techniques (T1059.AI, T1562.AI). 100+ CISA KEV CVEs tracked.
✓ Web · API · LLM · MITRE ATT&CKRedis-backed sliding window with atomic Lua scripts — no burst spikes, every window is a true sliding calculation. Three enforcement axes (API key, JWT user, IP) with priority ordering. In-memory fallback if Redis is unavailable.
✓ Lua atomic · 3-axis enforcementLogin: 5 requests / 60s, then 300s block on breach. Register: 3 / 300s, then 600s block. X-RateLimit-Limit / Remaining / Reset headers on every response so clients can self-throttle gracefully.
✓ Brute-force resistant by defaultOWASP-mapped: SQLi (5+ vectors incl. blind/boolean/time), XSS (5+ incl. stored/reflected/DOM), path traversal (5+), command injection (5+), SSRF blocklist, custom regex per org. Block / log / challenge actions with priority ordering.
✓ waf_rule_engine.py · 22KBPassive traffic analyzer compares discovered endpoints to api_inventory. Risk-scored on auth, HTTPS, rate-limit, PII, traffic. SHADOW_API_BLOCK_MODE auto-blocks above threshold. False-positive filter strips static assets, probes, scanner noise.
✓ FP ≤ 2% · FN ≤ 5%ML-based classification using behavioral fingerprinting (timing, ordering, paths) and TLS/JA3 handshake characteristics unique to each client. Five-class output: human, automation, bot, scraper, scanner.
✓ bot_detector.py · 27KBTrafficAnalyzer with bounded LRU caches (5K endpoints, 10K patterns). ProtocolDetector identifies REST / GraphQL / gRPC / WebSocket from headers. EndpointExtractor normalizes /users/123 → /users/{id} for consistent rule matching.
✓ Memory-bounded by designAuto-tags PII, payment data, secrets, and health data into Restricted / Confidential / Internal / Public tiers. Field-level encryption options per classification, with per-field GDPR / HIPAA / PCI-DSS tagging for evidence.
✓ data_classifier.pyEvery API request, decision, and block written to an immutable hash chain — each entry signs the previous via SHA-256. Three verification levels (full chain, single entry, last-N). Tamper attempts break downstream hashes.
✓ Tamper-evident · SOC 2 / HIPAA / FedRAMP AU-9Common questions about protecting your APIs with G8KEPR
Need help securing your APIs?
Talk to our API security experts →Every blocked request, rate-limit event, and policy violation is mapped to specific controls in 14 compliance frameworks. Auditors get exports — not spreadsheets.
Subject to independent audit and attestation. G8KEPR provides the technical controls and evidence — your auditor issues the certification.
5-tier detection, 1,524 patterns, 7 evasion vectors handled, shadow API auto-block, and 2,000+ mapped compliance controls — across REST, GraphQL, gRPC, and WebSocket.
No credit card required • Deploy in 5 minutes • Cancel anytime