Runtime security forAI agents.
Your agents read emails, call tools, browse the web and keep memory. Attackers hide instructions in all of it. SynaptoSec inspects every channel (prompts, tool results, MCP schemas and memory writes) before your agent acts on it.
// Single-node load test, Amsterdam: clean path 0.050 ms. Detection results and their limits are in section 04.
The attack surface has moved beyond the chat endpoint.
Many inline filters concentrate on the user prompt. Agent deployments also need the tool, MCP and memory channels covered explicitly.
TOOL RESULT INJECTION
An external tool returns a payload containing embedded instructions. The agent parses it as trusted context and executes it. The user's initial prompt is completely benign; the attack arrives through the tool channel.
MCP TOOL POISONING
An adversary alters Model Context Protocol (MCP) tool schema descriptions to embed shadow parameters or covert exfiltration instructions.
MEMORY POISONING (MINJA)
An attacker plants an instruction inside an ingested document. The agent writes it into long-term vector memory as a fact. Retrieval triggers weeks later, completely breaking the causal chain in time. ASR without defense: 98.2%, as reported by the MINJA authors in their paper's own tests.
INDIRECT INJECTION VIA RAG
A retrieved knowledge chunk contains hidden instruction overrides. The agent obeys the chunk instructions rather than the user intent. The user never sees the poisoned text.
Regulation and measured exposure.
For providers of high-risk AI systems, Article 15 of the EU AI Act requires technical measures against AI-specific attacks such as data poisoning and adversarial examples. NIS2 adds cyber-risk governance duties for covered entities. Whether your system is classified as high-risk is a question for your legal team.
Agent deployments are growing faster than most security teams can assess their threat surface. SynaptoSec is built for the agentic layer: tools, MCP, memory and the model's own output.
Our approach.
SynaptoSec is an inline firewall for AI agents. We cover three layers in one integration: inbound (the prompt), agentic (tool calls, MCP metadata, memory writes), and outbound (model responses).
AGENTIC LAYER INSPECTION
Tool results, MCP metadata, and memory writes are parsed as distinct trust classes before entering context.
EU SOVEREIGN DEPLOYMENT
Our servers are in Amsterdam. Cases that need a second opinion from a language model may be sent to external LLM providers under Standard Contractual Clauses; an EU-only inference mode is planned. Designed to support GDPR, NIS2 and EU AI Act compliance.
RESEARCH-DERIVED DETECTION
Detection rules are informed by published research; sources are listed in our research pages.
Layered detection pipeline
A fast deterministic prefilter clears the clean path in microseconds; ambiguous and adversarial inputs escalate to deeper semantic analysis — all CPU-only.
Tool & MCP guards
Tool results, MCP metadata, and memory inserts are parsed before entering context.
Leakage guard
System-prompt leakage, secrets, PII redaction, repetition loops, active content.
Measured numbers.
Measured by us on a single node. Not independently audited. Not a guarantee.
| Metric | Value | Verification basis |
|---|---|---|
| Regression corpus: 712 attack samples | 712/712 blocked (regression corpus; coverage, not accuracy) | written and run by us. We developed against this set, so read it as regression coverage, not as accuracy. |
| Benign corpus: 700+ | 0 false positives on 700+ internal benign controls | our own controls, self-written. With a sample this size the true rate could still be up to about 0.4% (95% upper bound); a larger, independent benign corpus is being built. |
| External benchmark (deepset/prompt-injections) | 66.5% raw detection (175/263), 0 of 399 benign samples flagged | public test set (current 662-sample set, measured 2026-10-08). "Raw" means all 263 injection-labelled samples; the misses are dominated by out-of-scope content-policy attacks, not by in-scope prompt-injection grammar. |
| OWASP ASI evaluation (safelabs-eval) | 0 vulnerable / 0 fail | self-run, 300 adversarial prompts |
| Clean path latency | 0.050ms | single node, our load test (2026-09-29) |
| Fast block path latency | 12μs | single node, our load test (2026-09-29) |
| Sustained throughput | 100 RPS | sustained at p99 43.2ms (official protocol, our load test, 2026-10-06); up to ~283 RPS cache-hot |
| Persistence crash-window | 5s | aiosqlite WAL + 5s disk checkpoint |
// Measured by us on a single node. Not independently audited. Not a guarantee.
Architectural boundaries.
Security claims require unambiguous scope. We document where our inspection begins and where it ends.
Model-weight backdoors. Detection is behavioral and runtime-focused; we do not inspect weights.
Chat template backdoors at inference. Jinja template executes before our inspection point.
Hidden chain-of-thought. We observe outputs and tool exchanges, not model internal token latents.
Cross-modal injection (audio, image, video). Research-stage; requires dedicated GPU pipelines.
Market exclusivity. Lakera, Prompt Security, Fortinet, and Palo Alto cover other layers. We do not claim otherwise.
// Published limitations, not hidden limitations.
Deploy inline protection in minutes.
Point your reverse proxy or autonomous agent gateway to SynaptoSec. Six layers of zero-trust verification with sub-millisecond clean path latency.
# Example standalone inspection (cURL)curl -X POST https://synaptosec.com/v1/batch-check \ -H "Authorization: Bearer <YOUR_API_KEY>" \ -H "Content-Type: application/json" \ -d '{"texts": ["user query"]}'// Direct HTTP API. Python, Node.js & LangChain SDKs: coming soon.
// Community plan: 5,000 requests per month at no cost during early access. We issue keys manually; write to PUBLIC_CONTACT_EMAIL (src/config) or use the early-access button.
Questions we get.
How do you handle my prompts?
Prompts and responses are processed to return a verdict. Our verified statement of content handling and retention is being finalized and will be published on our privacy page. We log metadata (timestamp, endpoint, verdict, latency).
Where is my data processed?
Our servers are in Amsterdam. Cases that need a second opinion from a language model may be sent to external LLM providers under Standard Contractual Clauses; an EU-only inference mode is planned.
What if the LLM providers are down?
Our deterministic layers (which handle the clean path and most blocks) run entirely on our servers and are unaffected. If the external LLM guard is unreachable, the request is passed through (fail-open) so your traffic is not interrupted — the same trade-off most inline proxies make during infrastructure failure. A per-tenant fail-closed setting is planned.
How is this different from other AI firewalls?
They cover real parts of the problem. We focus on the agent channels (tools, MCP, memory), on pre-training data audits, and on publishing our limitations.
SynaptoSec is built in Antwerp by Timofej Bogdanov. We are early. If you run agents in production and want to test us, write to synaptosec@gmail.com.