← All posts

Platform & Architecture

145 posts on platform & architecture.

Securing MCP Servers in Production: An Implementation Guide

A hands-on guide to running Model Context Protocol servers securely on the HTTP transport: stand up the server as an OAuth 2.1 resource server, validate token audience per request, authorize each tools/call against role and arguments, propagate caller identity downstream, constrain egress, and log every decision. Includes policy and validation snippets and a production checklist, plus the line where stdio servers leave the gateway.

ai-securityagentic-aillm-securityidentity-and-authorizationarchitecture
Read post →

MCP Gateway Security: Enforcing Policy on Remote Tool Traffic

A remote MCP server turns tool calls into HTTP traffic between an agent and an endpoint. That traffic is where an MCP gateway enforces identity-bound policy and records each tool invocation. This covers what an MCP gateway checks, why remote Streamable HTTP transport is the enforcement surface, and where local STDIO servers sit outside it.

mcpai-securityagentic-aipolicy-enforcementinline-enforcementarchitecture
Read post →

MCP OAuth 2.1 Security: Authorization Enforcement for Remote Servers

MCP''s authorization spec builds on OAuth 2.1, which sets the token rules but leaves the per-call decision to you. This walks through the MCP OAuth flow for remote servers, the confused-deputy risk it introduces, and why an enforcement point that evaluates every tool call against the acting identity is the control that OAuth alone does not provide.

mcpidentity-and-authorizationai-securityagentic-aipolicy-enforcementarchitecture
Read post →

LLM Gateway Security: What an Enforcement Layer Checks on Every Request

An LLM gateway that only routes and rate-limits leaves the security decision to the model. This walks through what a security-grade LLM gateway evaluates on every request: verified identity, model authorization, prompt-level data classification, a fail-closed decision, and a per-decision audit record committed before the response returns.

llm-securityai-securityinline-enforcementpolicy-enforcementarchitectureaudit
Read post →

Langflow CVE-2026-55255: Multi-Tenant Secret Isolation and AI Provider Keys

On July 8, 2026 Help Net Security reported active exploitation of CVE-2026-55255, a CVSS 9.9 cross-tenant IDOR in Langflow that lets one tenant read another tenant's embedded secrets: LLM provider keys, cloud credentials, database passwords. CISA set a July 10 federal mitigation deadline. The architectural lesson is about where AI orchestration tools keep long-lived provider keys, and why a stateless gateway that holds none of them gives a secret-harvest bug far less to reach.

ai-securityllm-securitycybersecurityai-gatewayarchitecture
Read post →

AI Agent Memory Security: What a Gateway Sees, and What Persists Where It Cannot Reach

Agent memory spans the context window, provider-hosted long-term memory, vector-store RAG memory, and local file state. Attacks like MINJA, SpAIware, the Gemini delayed-tool-invocation poisoning, and the July 2026 MemGhost paper corrupt that memory through prompt content. This article maps each memory type and attack to the HTTP AI request boundary, and is blunt about which steps a gateway can see and which persist where it cannot reach.

agentic-aillm-securityprompt-injectionai-securityarchitectureforensic-audit
Read post →

AI Egress Control Implementation: Allowlisting the Destination Does Not Govern the Payload

Teams implement AI egress control with DNS filtering, SNI inspection, forward proxies, Kubernetes NetworkPolicy, and Cilium FQDN rules. Each governs the destination of AI traffic without reading the prompt, and Kubernetes NetworkPolicy cannot express FQDNs at all. This article gives working Cilium and Envoy egress config, explains why each layer stops at the destination, and shows why reading the payload requires sitting on the decrypted HTTP path.

ai-securityarchitecturezero-trustkubernetesinline-enforcementllm-security
Read post →

AI Gateway Latency Benchmarks: Reading the 2026 Numbers Without Getting Fooled by the Mock Upstream

AI gateway latency benchmarks in 2026 report figures from microseconds to tens of milliseconds, but almost all of them measure proxy forwarding against a mock upstream, which deletes the largest real-world variable. This article defines the metrics that matter, reads the LiteLLM, Bifrost, Kong, and Portkey numbers with their methodology caveats, and shows why gateway overhead is a small fraction of provider TTFT and how to keep policy evaluation off the critical path.

ai-gatewayarchitectureinline-enforcementai-securityllmpolicy-enforcement
Read post →

Prompt Injection Testing: Building a Repeatable Program Instead of a One-Off Red Team

A one-time red team tells you whether an app was vulnerable last month. A testing program tells you whether every deploy still is. This guide walks how to build repeatable prompt injection testing: assemble a corpus across direct and indirect vectors, wire a runner into CI, measure attack success rate against a defined objective, and account for the adaptive-attack ceiling that static corpora miss. It marks why testing measures exposure and enforcement closes it.

ai-securityprompt-injectionllm-securitydevsecopsarchitecture
Read post →

LlamaIndex Security Patterns: Trust Boundaries in a RAG Pipeline

A LlamaIndex application ingests documents, retrieves chunks, and synthesizes an answer, and each stage is a trust boundary. This article walks the security patterns that matter: enforce per-user document access at retrieval, treat ingested content as untrusted, scope query-engine tools, and govern the model call and its response. It marks which controls live in your ingestion code and which need an enforcement layer on the HTTP path to the model.

ai-securityllm-securityarchitectureidentity-and-authorizationzero-trust
Read post →

LLM Output Validation Patterns: Four Layers Before You Trust a Model Response

Model output gets treated as trusted input to the next step, which is how a hallucinated field, an injected instruction, or a leaked value becomes an action. This article lays out four layers of LLM output validation: structural schema checks, content and safety filtering, grounding and semantic checks, and action gating on tool calls. It shows where each layer catches what, and why the action-gating layer belongs on an enforcement point outside the application.

ai-securityllm-securityarchitecturepolicy-enforcementinline-enforcement
Read post →

LLM Security Testing: The Four Categories and What Each One Measures

LLM security testing spans four categories that measure different failures: prompt injection resistance, jailbreak resistance, data exfiltration exposure, and output safety. This article defines each category, the objective it tests, and the metric it reports, then wires them into a repeatable program with a CI gate. It marks the point every testing effort has to state: testing quantifies exposure, and an enforcement layer is what closes it at runtime.

ai-securityllm-securityprompt-injectiondevsecopsarchitecture
Read post →