Web attacks
Injection attempts hidden in URLs, forms and JSON.
- SQL injection
- Cross-site scripting (XSS)
- Command injection
- Path traversal to server files
- Server-side request forgery (SSRF)
Stop attacks on the wire, before they reach your app.
Mr Warden is AI-powered protection that sits in front of your application as a proxy or sidecar. It peels every encoding layer off a request, scores attacker intent in microseconds, and blocks the next move, with no change to your code.
- 35 µs
- Tier 0 decision, p99
- < 0.5 ms
- added latency, p99
- Fail-open
- by default, closed per route
0inspected
0stopped
0forwarded
What Mr Warden stops.
AI-powered detection for websites, APIs and AI features, blocking common attacks out of the box.
API abuse
Misuse that looks like normal traffic at first.
- Password guessing and spraying
- Walking through user or order IDs
- Scanning for hidden pages
- Tampering with admin or role fields
- Oversized exports and costly queries
AI agents
For chatbots, copilots and tool-using agents.
- Prompt injection, direct and hidden
- Tools used outside their permission
- Tool definitions changed after approval
- Secrets leaking in replies
- Runaway tool loops and token spend
Bots
Keeps unwanted automation away from your app.
- AI crawlers that ignore robots.txt
- Bots faking a trusted identity
- Scanners probing for files
- Fake sign-ups at scale
- Decoy pages that trap scanners
Every detection tells you
- How risky it was, from 0 to 100
- What kind of attack it was
- Where it came from
- What Mr Warden did about it
Three steps on every request.
Mr Warden sits between your users and your app. It checks each request in microseconds, with no change to your code.
-
1
Unwrap
Removes the disguises attackers use to slip past filters.
- URL and double URL encoding
- HTML entities, JSON escapes and Base64
- Hidden and look-alike Unicode characters
-
2
Score
Rates how dangerous the request looks, from 0 to 100.
- SQL injection, XSS, command injection, SSRF
- Prompt injection and unsafe AI tool calls
- Bots, abuse and rate limits
-
3
Act
Lets it through, asks for proof, or blocks it.
- Blocked requests never reach your app
- Leaked secrets are removed from AI replies
- Shadow mode reports without blocking
It also remembers.
One request can look harmless. Mr Warden follows each client over time, and once a pattern turns hostile, that client's next request is stopped before it is even scanned.
5 failed logins in a minuteChallenge
8 missing pages in a minuteTag
Keeps going after a challengeBlock
AI agent calls a tool it isn't allowed toBlock
See every decision. Flip to block when you're ready.
- Deploy in shadow. Run it as a sidecar, a gateway, an Envoy Wasm filter or ext_proc. Nothing is blocked yet.
- Watch the dashboard. Detections stream in with risk, kill-chain stage, technique and origin on a live globe.
- Turn on Block. One switch takes every sensor out of shadow mode within seconds.
MrWardenLive
Detections0
Blocked0
Avg risk0
DecisionRequestThreatLocation
Compare plans
| Feature | Free$0 | Premium | EnterpriseCustom |
|---|---|---|---|
| AI security | |||
| Prompt injection | Detect only | ||
| Unsafe AI tool calls | Detect only | ||
| Secrets removed from AI replies | — | ||
| Protection | |||
| SQL injection, XSS and other web attacks | |||
| Credential stuffing and password spray | Detect only | ||
| Scraping, ID walking and bad bots | Detect only | ||
| Decoy pages and honeypots | — | ||
| Usage | |||
| Applications | 1 | 5 | Unlimited |
| Requests per month | 100k | 10M | Unlimited |
| Detection history | 7 days | 90 days | 1 year |
| Control | |||
| Shadow mode and Block switch | |||
| Live dashboard and attack map | |||
| Custom policies and signed rule packs | — | — | |
| Kubernetes sidecar, Envoy and Istio | — | — | |
| Export detections to your SIEM | — | — | |