243 posts on platform & architecture.
A remote MCP server turns tool calls into HTTP traffic between an agent and an endpoint. That traffic is where an MCP gateway enforces identity-bound policy and records each tool invocation. This covers what an MCP gateway checks, why remote Streamable HTTP transport is the enforcement surface, and where local STDIO servers sit outside it.
MCP''s authorization spec builds on OAuth 2.1, which sets the token rules but leaves the per-call decision to you. This walks through the MCP OAuth flow for remote servers, the confused-deputy risk it introduces, and why an enforcement point that evaluates every tool call against the acting identity is the control that OAuth alone does not provide.
An LLM gateway that only routes and rate-limits leaves the security decision to the model. This walks through what a security-grade LLM gateway evaluates on every request: verified identity, model authorization, prompt-level data classification, a fail-closed decision, and a per-decision audit record committed before the response returns.
On July 8, 2026 Help Net Security reported active exploitation of CVE-2026-55255, a CVSS 9.9 cross-tenant IDOR in Langflow that lets one tenant read another tenant's embedded secrets: LLM provider keys, cloud credentials, database passwords. CISA set a July 10 federal mitigation deadline. The architectural lesson is about where AI orchestration tools keep long-lived provider keys, and why a stateless gateway that holds none of them gives a secret-harvest bug far less to reach.
Agent memory spans the context window, provider-hosted long-term memory, vector-store RAG memory, and local file state. Attacks like MINJA, SpAIware, the Gemini delayed-tool-invocation poisoning, and the July 2026 MemGhost paper corrupt that memory through prompt content. This article maps each memory type and attack to the HTTP AI request boundary, and is blunt about which steps a gateway can see and which persist where it cannot reach.
Teams implement AI egress control with DNS filtering, SNI inspection, forward proxies, Kubernetes NetworkPolicy, and Cilium FQDN rules. Each governs the destination of AI traffic without reading the prompt, and Kubernetes NetworkPolicy cannot express FQDNs at all. This article gives working Cilium and Envoy egress config, explains why each layer stops at the destination, and shows why reading the payload requires sitting on the decrypted HTTP path.
A one-time red team tells you whether an app was vulnerable last month. A testing program tells you whether every deploy still is. This guide walks how to build repeatable prompt injection testing: assemble a corpus across direct and indirect vectors, wire a runner into CI, measure attack success rate against a defined objective, and account for the adaptive-attack ceiling that static corpora miss. It marks why testing measures exposure and enforcement closes it.
A LlamaIndex application ingests documents, retrieves chunks, and synthesizes an answer, and each stage is a trust boundary. This article walks the security patterns that matter: enforce per-user document access at retrieval, treat ingested content as untrusted, scope query-engine tools, and govern the model call and its response. It marks which controls live in your ingestion code and which need an enforcement layer on the HTTP path to the model.
Model output gets treated as trusted input to the next step, which is how a hallucinated field, an injected instruction, or a leaked value becomes an action. This article lays out four layers of LLM output validation: structural schema checks, content and safety filtering, grounding and semantic checks, and action gating on tool calls. It shows where each layer catches what, and why the action-gating layer belongs on an enforcement point outside the application.
LLM security testing spans four categories that measure different failures: prompt injection resistance, jailbreak resistance, data exfiltration exposure, and output safety. This article defines each category, the objective it tests, and the metric it reports, then wires them into a repeatable program with a CI gate. It marks the point every testing effort has to state: testing quantifies exposure, and an enforcement layer is what closes it at runtime.
A checklist you can run against a Model Context Protocol deployment, grouped into transport, authentication, authorization, egress, audit, and supply chain, with an explicit pass criterion for each item. It is written as an audit instrument rather than an essay, and it marks which items a network control can verify on the HTTP transport and which belong to host hardening for stdio servers.
Teams front Azure OpenAI with a gateway for four different jobs: token-based rate limiting, cost attribution, load balancing across regional deployments, and content policy on prompts. This article walks the three deployment patterns engineers actually run on Azure API Management, shows working GenAI policy config, and marks the line between what Azure APIM enforces at the request envelope and what governing the prompt payload requires.