How ekmire works
Architecture, the threat-feed pipeline, and how the three layers compose.
Architecture
Three components ship as separate artifacts: the proxy (Rust, single static binary), the CLI (Python, plus standalone binary), and the MCP server (stdio, runs locally). All three talk to a thin cloud control plane for auth, telemetry, and rule-bundle distribution.
Request lifecycle
Every inbound request hits the proxy first. The proxy applies header deception, IP reputation, and deterministic rule matching. If the request passes those, it runs through the semantic analyzer (LLM-backed). On a pass, the request is forwarded to your upstream.
Rule bundle distribution
Bundles are signed with Ed25519 by Flux8Labs. The proxy fetches the latest bundle every 60s and verifies the signature before hot-reloading. There is no scenario where a tampered bundle can run on your proxy.