Toolkit overview

ekmire operates at three distinct points in the software lifecycle. You can adopt any combination — each layer provides independent value and feeds signal into the shared dashboard.

┌─────────────────────────────────────────────────────────────┐
│  WRITE TIME          │  COMMIT TIME         │  RUNTIME       │
│  MCP server          │  Build Guard CLI     │  Rust proxy    │
│  In your IDE         │  git pre-commit hook │  Docker sidecar│
│  <50ms, local-only   │  Offline, signed     │  <5ms p99      │
└─────────────────────────────────────────────────────────────┘
                               ↓
                    ┌──────────────────────┐
                    │  ekmire Dashboard    │
                    │  Events · Rules · AI │
                    └──────────────────────┘

Runs on every git commit via a pre-commit hook. Deterministic, offline, zero-latency after initial bundle pull.

What it catches:

• Hardcoded API keys — AWS, GCP, GitHub, Anthropic, OpenAI, Razorpay
• Generic high-entropy secrets
• Static prompt injection strings in code comments and strings
• SQL injection via unsafe ORM execute() calls (Python AST)
• Dangerous deserialization — pickle.loads, marshal.loads
• Command injection — subprocess.run(shell=True), os.system
• Unsafe yaml.load without Loader
• MCP tool poisoning — hidden instructions in tool descriptions

Suppression: add # ekmire-ignore:RULE_ID above the flagged line. Suppressions are logged to the dashboard for review.

Languages: Regex rules are language-agnostic. AST rules currently support Python; more languages are in the roadmap.

→ Build Guard reference

A Rust reverse-proxy sidecar that intercepts every inbound HTTP request before it reaches your application. Two-stage pipeline:

1. Deterministic rules — regex rules from the signed bundle. Runs in <2ms with no external calls.
2. Semantic analyzer — LLM-backed scoring for payloads that pass deterministic rules. Uses your BYOK key or ekmire's inference pool.

What it catches (deterministic rules):

• Prompt injection in LLM-facing API endpoints
• Jailbreak attempts (DAN, persona hijacking, instruction override)
• Hardcoded credentials in request bodies (AWS keys, GitHub tokens, Stripe keys, etc.)
• MCP server network exposure patterns
• Known bad IP addresses (nightly reputation feed)

Actions on match: block (403), tarpit (1 byte/s drain), log-only, or scraper poisoning (see below).

→ Proxy setup · Detection pipeline

An optional second stage in the proxy pipeline. Scores each request payload against a threat model using an LLM. The score drives three thresholds configured per-proxy:

• EKMIRE_SEMANTIC_BLOCK_SCORE — default 0.85. Requests above this are blocked.
• EKMIRE_SEMANTIC_LOG_SCORE — default 0.60. Requests above this are logged as medium severity.
• EKMIRE_SEMANTIC_FALLBACK — pass or block. What happens when the LLM provider is unreachable.

Providers supported: OpenAI, Anthropic, Groq, Ollama (local). Configure in the Dashboard → Settings → LLM provider, or set BYOK credentials directly in the dashboard.

→ BYOK setup

ekmire's rule bundle is updated nightly from two sources:

1. NVD (National Vulnerability Database) — new CVEs are processed by an LLM to generate detection patterns.
2. Crowd-source — semantic blocks from across the ekmire fleet are aggregated. When 5 or more distinct organisations see the same payload hash within 7 days, it enters the human review queue at Flux8Labs.

Every bundle is signed with Ed25519 by Flux8Labs before distribution. The proxy verifies the signature before hot-reloading (every 60 seconds). A tampered or unsigned bundle is rejected and the previous bundle remains active.

→ Rule bundle format · Rule ID reference

Two deception techniques available in the proxy configuration:

Tarpit: instead of immediately returning 403, the proxy drains the connection at 1 byte/s (configurable). After 3 consecutive blocked requests from the same source (configurable), the source is tarpitted. Effective against automated scanners and credential-stuffing bots.

Scraper poisoning: for requests identified as AI scrapers, the proxy injects zero-width watermark characters into the response body and returns plausible-looking but fabricated data. The watermark allows downstream attribution if the poisoned content is later found in a model's training set.

Header deception: the proxy randomises the Server header using a configurable list of decoy server strings (default: nginx, Apache, Cloudflare), preventing fingerprinting.

→ Tarpit · Scraper poisoning

An MCP server that runs locally in your IDE and tails the active buffer. Designed for AI-assisted coding environments where the LLM edits your code in real time.

What it catches:

• MCP tool poisoning — hidden instructions injected into tool descriptions (MCP_TOOL_POISONING)
• MCP server network exposure — servers exposing ports beyond localhost (MCP_SERVER_NETWORK_EXPOSURE)
• MCP config rug-pull risk — servers with ambiguous command paths (MCP_CONFIG_RUG_PULL_RISK)
• Hidden instructions in code comments — steering the AI assistant through comments (HIDDEN_INSTRUCTION_IN_COMMENT)
• Prompt injection strings embedded in source code (PROMPT_INJECTION_STATIC)

Supported IDEs: Cursor, Claude Code, Continue.dev, Zed — any IDE with MCP support.

Performance: sub-50ms per buffer change. Local-only — no network calls in deterministic mode.

→ MCP server setup

The cloud control plane at app.ekmire.com. Everything your proxy and CLI send is visible here.

• Events — every block, log, or suppressed finding across all layers, with severity, payload hash, rule ID, and source (cli, proxy, mcp, device_scanner, dev_audit).
• Rules feed — the current signed bundle contents. Submit false-positive reports for any rule.
• Alerts — Slack, email, and generic webhook delivery for critical events. Configurable per severity threshold.
• API keys — generate, rotate, and revoke project API keys. Each key is bcrypt-hashed; the plaintext is shown exactly once.
• Team — invite members (Pro/Team plans). Roles: owner, admin, member. Members can view events; admins can manage rules and alerts; owners manage billing and keys.
• Billing — Razorpay (India, INR) and Stripe (global, USD). Plan upgrades and downgrades take effect immediately.