A thread · 23 notes · G8KEPR
Building G8KEPR.
What my security startup does, why it's built the way it is, and what it's like building it alone.
- 1
What G8KEPR Is, in Plain English
The security startup I build on nights and weekends, explained without the jargon: what it guards, how it does it, and where it runs.
- 2
Four Checkpoints on One Request: The G8KEPR Pillars
API security, MCP security, an AI gateway and a verification engine, one at a time: what each one looks at and what it's there to catch.
- 3
MCP Tool Poisoning, and Why G8KEPR Fingerprints Every Tool
What MCP is, how a tool's own description can be turned against the model reading it, and why a hash that's re-checked on every call is such a useful tripwire.
- 4
No LLM-as-Judge: Why G8KEPR Uses Regex and Classical ML
A lot of AI security tools ask another AI model to grade the first one. G8KEPR doesn't. Here's why, what it costs, and what the published numbers do and don't mean.
- 5
Why It Runs in Your VPC (and Nothing Leaves)
G8KEPR is self-hosted by design: deployed with Helm or Terraform, sitting in your request path, sending zero bytes out and charging nothing per token. Here's the reasoning.
- 6
Building a Security Startup by Myself
One founder, a Delaware C-Corp, evenings and weekends, and a codebase with more lines of tests than lines of code. Here's what that ratio says about how I build.
- 7
From Do-Everything Platform to Correlation Engine
G8KEPR started as an AI security platform that tried to do everything. In September 2026 I narrowed it to the one thing that's actually different, and kept most of what I'd built.
- 8
Open Source for About a Day
On September 9 I decided G8KEPR would be open source under Apache-2.0. On September 10 I changed my mind. Both days had good arguments.
- 9
A Scorecard Instead of a Vanity Metric
How I keep score on G8KEPR with a feature scorecard graded 0 to 10, why it leaves out anything about clients or partners, and the P0-P4 lists that decide what I work on next.
- 10
How I Build with Three Claude Code Agents at Once
My build loop for G8KEPR: a plan in Todoist, a tracker page, three DEV briefs, and three Claude Code windows working in parallel while I supervise until it's done and tested.
- 11
Prompt Injection, Explained Without the Jargon
What prompt injection actually is, why it's so stubborn to fix, how it sneaks in through documents and tools, and where G8KEPR's guard sits in the path.
- 12
Checking the Answer, Not Just the Question
Most AI security looks at what goes into a model. G8KEPR's Verification Engine also looks at what comes out, with four kinds of checks and grounding at the center.
- 13
Keeping Secrets Out of Prompts
People paste passwords, keys and customer data into AI tools all the time, usually for perfectly good reasons. Here's why G8KEPR redacts that stuff before it ever leaves.
- 14
A Budget for Your AI Bill
Runaway agents, retry loops and sudden spend spikes can turn an AI feature into a very expensive surprise. Here's why G8KEPR treats cost as a security problem.
- 15
One Gateway, Many Models
How G8KEPR's AI Gateway routes requests across many model providers, what circuit breakers and bring-your-own-key mean, and why one checkpoint beats security bolted onto every app.
- 16
The Lethal Trifecta and Other Attacks That Take More Than One Step
Some of the worst AI attacks are made of steps that each look harmless. Here's the lethal trifecta idea, and why G8KEPR's correlation engine looks across all four pillars at once.
- 17
Agents That Turn on You: Hijacking and Memory Poisoning
What agent hijacking and memory poisoning are, why agents raise the stakes, and what G8KEPR's MCP-side controls (tool permissions, session tracking, rug-pull detection) are there for.
- 18
Why Security Tools Shouldn't Phone Home
A security tool sees your most sensitive traffic, so where it sends that traffic matters. The trust argument behind keeping G8KEPR entirely inside your own infrastructure.
- 19
Why I Publish G8KEPR's Pentest Results
G8KEPR 1.0 shipped with an independent pentest result of 0 critical, 0 high and 3 medium findings, and the company blog publishes red-team runs too. Here's why a security product should show its homework.
- 20
From 1.0 to 1.5: Reading G8KEPR's Changelog as a Story
G8KEPR went GA on April 14, 2026 and reached v1.5 by May 9. A walk through that stretch of the public changelog, and what I think a changelog is actually for.
- 21
P0: Blocks Belief
Every G8KEPR task list runs from "P0 — Blocks belief/purchase" down to "P4 — Polish". Why belief is the right word for a security product, and how it keeps a solo founder honest.
- 22
A Free Scanner as the Front Door
The plan, not yet shipped, for a free MCP security CLI scanner: why I'd give a tool away, and the questions it's meant to help people running MCP servers answer.
- 23
What an AI Security Layer Is Not
G8KEPR is a layer. It doesn't replace secure code, least-privilege tool design or the API gateway you already run. An honest look at where a runtime AI security layer fits and where it doesn't.