# Intelligent Nexus Security - Enterprise Security Gateway for MCP AI Agents

> Intelligent Nexus Security is a security gateway for Model Context Protocol (MCP). It sits between AI clients and MCP servers as a transparent proxy, providing threat detection, PII protection, policy enforcement, and audit logging for AI agent workflows.

## What is Intelligent Nexus Security?

Intelligent Nexus Security is an enterprise security gateway purpose-built for the Model Context Protocol (MCP). MCP is an open standard that allows AI agents (like Claude, GPT, and other LLM-based systems) to interact with external tools and data sources. Intelligent Nexus Security deploys as a transparent proxy between AI clients and MCP servers, requiring no code changes on either side.

## Problem

As organizations deploy AI agents that use MCP to access tools, new attack surfaces emerge:

- **Tool Poisoning**: Malicious instructions hidden in MCP tool descriptions that manipulate agent behavior
- **Rug Pull Attacks**: Tool descriptions silently modified after initial approval to inject hidden instructions
- **PII Data Leakage**: Sensitive data (SSNs, credit cards, emails) leaking through agent tool responses
- **Data Exfiltration**: Unauthorized extraction of sensitive data through tool call parameters
- **Unauthorized Tool Access**: Agents accessing tools beyond their permitted scope

Traditional security tools cannot detect these MCP-specific threats.

## Key Features

### Threat Detection Engine
- 39+ threat detection patterns across 10 threat categories
- 4 specialized detectors: tool poisoning, PII exposure, data exfiltration, anomaly detection
- Real-time analysis of all MCP traffic

### PII Protection
- Automatic detection and masking of 13 types of sensitive data
- Covers SSN, credit cards, emails, phone numbers, IP addresses, and more
- Applied to both requests and responses

### Policy Engine
- 4 policy actions: deny, require approval, mask, notify
- 7 condition operators: equals, not_equals, contains, not_contains, starts_with, ends_with, regex
- Conditions based on: tool, alias, method, agent, mcp_server

### Session Correlation
- 4-layer correlation engine: explicit, standard (W3C traceparent), temporal, semantic
- Tracks data flow across requests to detect exfiltration chains
- Risk scoring per session

### Anomaly Detection
- Behavioral analysis for burst requests, off-hours access, parameter anomalies
- Configurable thresholds and ML-ready architecture

### Audit & Compliance
- Complete audit trail of all MCP interactions
- Scheduled compliance reports
- Designed for SOC 2 and GDPR readiness

## Architecture

Intelligent Nexus Security deploys as a transparent proxy:

```
AI Client (Claude, GPT, etc.) → Intelligent Nexus Security Gateway → MCP Server
```

- **Gateway Service**: REST API, security checks, real-time threat detection (hot path)
- **Worker Service**: Async processing, scheduled jobs, notifications (cold path)
- **Dashboard**: Real-time monitoring, policy management, session tracking

## Technology Stack

- Backend: Java 21, Spring Boot 3.3, MyBatis
- Frontend: Next.js 14, React, TypeScript, Tailwind CSS
- Database: PostgreSQL 16 with JSONB
- Cache: Redis 7
- Queue: Apache Kafka

## Threat Types Detected

1. Tool Poisoning
2. Rug Pull Attacks
3. Data Exfiltration
4. PII Leak
5. Anomaly
6. Rate Limit Exceeded
7. Policy Violation
8. Unauthorized Access
9. Malicious Payload
10. Injection Attack

## Getting Started

Intelligent Nexus Security is currently in early access. Sign up at https://ins.security to join the waitlist.

## Links

- Website: https://ins.security
- Privacy Policy: https://ins.security/privacy-policy.html