What G8KEPR Is, in Plain English
The security startup I build on nights and weekends, explained without the jargon: what it guards, how it does it, and where it runs.
Thread: Building G8KEPR ↗4 min readRead note
Tagged · 23 notes
#G8KEPR.
Everything tagged G8KEPR, wherever it's filed, newest first.
Four Checkpoints on One Request: The G8KEPR Pillars
API security, MCP security, an AI gateway and a verification engine, one at a time: what each one looks at and what it's there to catch.
Thread: Building G8KEPR ↗4 min readRead note
MCP Tool Poisoning, and Why G8KEPR Fingerprints Every Tool
What MCP is, how a tool's own description can be turned against the model reading it, and why a hash that's re-checked on every call is such a useful tripwire.
Thread: Building G8KEPR ↗4 min readRead note
No LLM-as-Judge: Why G8KEPR Uses Regex and Classical ML
A lot of AI security tools ask another AI model to grade the first one. G8KEPR doesn't. Here's why, what it costs, and what the published numbers do and don't mean.
Thread: Building G8KEPR ↗4 min readRead note
Why It Runs in Your VPC (and Nothing Leaves)
G8KEPR is self-hosted by design: deployed with Helm or Terraform, sitting in your request path, sending zero bytes out and charging nothing per token. Here's the reasoning.
Thread: Building G8KEPR ↗4 min readRead note
Building a Security Startup by Myself
One founder, a Delaware C-Corp, evenings and weekends, and a codebase with more lines of tests than lines of code. Here's what that ratio says about how I build.
Thread: Building G8KEPR ↗4 min readRead note
From Do-Everything Platform to Correlation Engine
G8KEPR started as an AI security platform that tried to do everything. In September 2026 I narrowed it to the one thing that's actually different, and kept most of what I'd built.
Thread: Building G8KEPR ↗4 min readRead note
Open Source for About a Day
On September 9 I decided G8KEPR would be open source under Apache-2.0. On September 10 I changed my mind. Both days had good arguments.
Thread: Building G8KEPR ↗4 min readRead note
A Scorecard Instead of a Vanity Metric
How I keep score on G8KEPR with a feature scorecard graded 0 to 10, why it leaves out anything about clients or partners, and the P0-P4 lists that decide what I work on next.
Thread: Building G8KEPR ↗4 min readRead note
How I Build with Three Claude Code Agents at Once
My build loop for G8KEPR: a plan in Todoist, a tracker page, three DEV briefs, and three Claude Code windows working in parallel while I supervise until it's done and tested.
Thread: Building G8KEPR ↗4 min readRead note
Prompt Injection, Explained Without the Jargon
What prompt injection actually is, why it's so stubborn to fix, how it sneaks in through documents and tools, and where G8KEPR's guard sits in the path.
Thread: Building G8KEPR ↗4 min readRead note
Checking the Answer, Not Just the Question
Most AI security looks at what goes into a model. G8KEPR's Verification Engine also looks at what comes out, with four kinds of checks and grounding at the center.
Thread: Building G8KEPR ↗4 min readRead note
Keeping Secrets Out of Prompts
People paste passwords, keys and customer data into AI tools all the time, usually for perfectly good reasons. Here's why G8KEPR redacts that stuff before it ever leaves.
Thread: Building G8KEPR ↗4 min readRead note
A Budget for Your AI Bill
Runaway agents, retry loops and sudden spend spikes can turn an AI feature into a very expensive surprise. Here's why G8KEPR treats cost as a security problem.
Thread: Building G8KEPR ↗4 min readRead note
One Gateway, Many Models
How G8KEPR's AI Gateway routes requests across many model providers, what circuit breakers and bring-your-own-key mean, and why one checkpoint beats security bolted onto every app.
Thread: Building G8KEPR ↗4 min readRead note
The Lethal Trifecta and Other Attacks That Take More Than One Step
Some of the worst AI attacks are made of steps that each look harmless. Here's the lethal trifecta idea, and why G8KEPR's correlation engine looks across all four pillars at once.
Thread: Building G8KEPR ↗4 min readRead note
Agents That Turn on You: Hijacking and Memory Poisoning
What agent hijacking and memory poisoning are, why agents raise the stakes, and what G8KEPR's MCP-side controls (tool permissions, session tracking, rug-pull detection) are there for.
Thread: Building G8KEPR ↗4 min readRead note
Why Security Tools Shouldn't Phone Home
A security tool sees your most sensitive traffic, so where it sends that traffic matters. The trust argument behind keeping G8KEPR entirely inside your own infrastructure.
Thread: Building G8KEPR ↗4 min readRead note
Why I Publish G8KEPR's Pentest Results
G8KEPR 1.0 shipped with an independent pentest result of 0 critical, 0 high and 3 medium findings, and the company blog publishes red-team runs too. Here's why a security product should show its homework.
Thread: Building G8KEPR ↗4 min readRead note
From 1.0 to 1.5: Reading G8KEPR's Changelog as a Story
G8KEPR went GA on April 14, 2026 and reached v1.5 by May 9. A walk through that stretch of the public changelog, and what I think a changelog is actually for.
Thread: Building G8KEPR ↗4 min readRead note
P0: Blocks Belief
Every G8KEPR task list runs from "P0 — Blocks belief/purchase" down to "P4 — Polish". Why belief is the right word for a security product, and how it keeps a solo founder honest.
Thread: Building G8KEPR ↗4 min readRead note
A Free Scanner as the Front Door
The plan, not yet shipped, for a free MCP security CLI scanner: why I'd give a tool away, and the questions it's meant to help people running MCP servers answer.
Thread: Building G8KEPR ↗4 min readRead note
What an AI Security Layer Is Not
G8KEPR is a layer. It doesn't replace secure code, least-privilege tool design or the API gateway you already run. An honest look at where a runtime AI security layer fits and where it doesn't.
Thread: Building G8KEPR ↗4 min readRead note