ekmire documentation
A developer security platform protecting at three layers — write time, commit time, and runtime — through one proxy, one CLI, one dashboard.
What ekmire is
ekmire is a developer security platform built by Flux8Labs. It catches security issues at write time (your IDE buffer, via an MCP server), at commit time (your git pre-commit hook, via the Build Guard CLI), and at runtime (your application traffic, via a Rust reverse-proxy sidecar).
Every plan ships every module. Pricing scales on volume and team size only. See ekmire.com/pricing for the full breakdown.
Where to start
If you have five minutes and a Docker Compose file, the quick start gets your first request blocked end-to-end:
Quick start
From zero to first blocked request in five minutes. Install the CLI, add two lines to Compose, watch the proxy block a prompt injection.
→ /quick-startCLI reference
Build Guard, Dev Audit, MCP server. Subcommands, flags, and exit codes for every operation the CLI exposes.
→ /cli/installProxy setup
Docker Compose, Kubernetes, and bare-metal deployment. The proxy is two lines added to your existing compose file.
→ /proxy/installToolkit overview
Every capability ekmire ships — Build Guard, Network Shield, Semantic Analyzer, Threat Feed, Active Deception, MCP Protection, and the Dashboard.
→ /toolkit-overviewThree layers, one signal
Most security tools cover one layer of the software lifecycle. ekmire's value is in the joined-up signal across all three:
- Write time — an MCP server tails your IDE buffer in Cursor, Claude Code, Continue, and Zed. Findings surface inline before the file hits disk. Sub-50ms. Local-only. No network.
- Commit time — Build Guard runs on every
git commit. Deterministic, signed, offline. Hardcoded secrets, injection patterns, and unsafe deserialization never reach the remote. - Runtime — a Rust reverse-proxy sidecar reads every request. Deterministic rules first, semantic analysis second. Prompt injection, SQL, command injection, jailbreaks — caught at the edge.
BYOK from day one
Most security vendors send your code to their LLM. ekmire ships a Bring Your Own Key path on the free tier. With BYOK, the proxy routes the call to your provider using your key, then forgets it — ekmire never logs prompts or responses. See Security · BYOK for the full architecture.