# Igris Security — Extended AI Content Reference

## Company Overview

Igris Security is an AI security and governance platform built for developers and enterprises
shipping AI-powered products. The platform covers every layer of the AI stack — from MCP server
vulnerability detection before deployment, to real-time governance of AI agent tool calls at
runtime, to LLM conversation protection in production, to unified observability across all
security events.

## Product Descriptions

### Igris Scanner
Igris Scanner is a CLI-based MCP vulnerability and CVE scanner for developers. Install via npm
or brew and run `igris scan` to automatically discover all connected MCP servers. Igris Scanner
runs 20+ security detectors checking for known CVEs (cross-referenced with the NIST NVD),
over-permissioned tool scopes, exposed credentials, injection vulnerabilities, and
misconfigured transport. It validates every server against 42+ compliance rules mapped to
OWASP, NIST AI RMF, SOC 2, EU AI Act, and ISO 27001. Output includes machine-readable JSON
for CI/CD and human-readable HTML or PDF reports. The core scanner engine is open source.

### Igris Sentinel
Igris Sentinel is an SDK-first MCP gateway that sits between AI agent applications and MCP
servers. Add the TypeScript, Python, or Go SDK and call `igris.getMcpConfig()` to route every
MCP tool call through the gateway. Sentinel enforces RBAC policies with metadata conditions
(role, team, environment), operates deny-by-default, injects AES-256-GCM encrypted upstream
credentials, tracks token usage per user and team, provides a real-time session kill switch,
and logs every interaction with user identity, trace ID, tool name, policy decision, and
latency. Overhead is under 1ms.

### Igris Guard
Igris Guard is an LLM firewall operating as a transparent proxy between users and any LLM —
OpenAI, Anthropic Claude, Google Gemini, Meta Llama, Mistral, or self-hosted models. No
provider changes required. It inspects every user prompt for PII, prompt injection attacks,
and policy violations before the model sees it. It validates every LLM response before
delivery, redacting sensitive data and flagging violations. It enforces user-level RBAC,
restricting models, topics, and features by role or team. A no-code policy builder lets
compliance teams manage content rules without engineering. Every interaction is fully logged.

### Igris Lens
Igris Lens is the unified observability and compliance dashboard for Igris Security. It
aggregates all security events, logs, traces, and anomalies from Igris Scanner, Igris Sentinel,
and Igris Guard into one real-time interface. CISOs get executive risk heatmaps. Compliance
teams generate one-click PDF reports for SOC 2, EU AI Act, GDPR, and NIST AI RMF. Security
engineers get trace-level debugging with full request/response context. All audit logs are
immutable and tamper-proof. SIEM integration via webhooks, REST API, or streaming logs.

## Compliance Frameworks Covered

SOC 2 Type II, EU AI Act (high-risk system requirements), GDPR, NIST AI Risk Management
Framework (AI RMF), ISO 27001, OWASP AI Security Top 10.

## Technical Facts

- MCP gateway latency: <1ms
- MCP tool calls governed daily: 5M+
- Security detectors in Igris Scanner: 20+
- Compliance rules in Igris Scanner: 42+
- Encryption: AES-256-GCM
- SDK languages: TypeScript, Python, Go
- LLM providers supported by Igris Guard: OpenAI, Anthropic, Google Gemini, Meta Llama,
  Mistral, custom/self-hosted models
- Deployment: managed cloud or self-hosted
- Log retention: 7 days (Community), 1 year (Pro), 3 years (Enterprise)

## Pricing Summary

- Community (Free): Igris Scanner CLI, basic Igris Sentinel (1K MCP tool calls/mo),
  Igris Lens with 7-day retention
- Pro ($99/mo): Full Igris Sentinel, Igris Guard, Igris Lens, 2M tool calls/mo, 10 seats,
  1-year retention
- Enterprise (Custom): Unlimited scale, SSO, self-hosting, 3-year retention,
  dedicated support, 99.95% SLA

## White papers

- [White papers](https://www.igrisecurity.com/resources/) — LLM runtime security and MCP agent governance
- [The Unguarded Prompt: Securing LLM Applications in Production](https://www.igrisecurity.com/resources/whitepapers/the-unguarded-prompt/) — Where LLM risk really comes from, eight runtime controls that address it, and how each maps to NIST AI RMF, ISO/IEC 42001, the EU AI Act, GDPR, and India's DPDP Act.
- [Zero Trust for MCP: Governing What AI Agents Do, Not Just What They Say](https://www.igrisecurity.com/resources/whitepapers/zero-trust-for-mcp/) — How MCP changes AI risk, eight controls for governing agent actions on every tool call, and how each maps to NIST AI RMF, ISO/IEC 42001, the EU AI Act, GDPR, and India's DPDP Act.