Pranor Gate

docker compose up -d

Pranor Gate is a high-performance, AI-native programmable API Gateway and reverse proxy for the Pranor ecosystem. It combines classical gateway capabilities (routing, auth, rate limiting) with cutting-edge AI middleware (prompt guard, semantic cache, MCP tool registry) and enterprise-grade reliability (circuit breaker, canary, WASM inline processing).

Performance & Benchmarks

Pranor Gate is engineered in Go for extreme throughput and low latency:

Quickstart & Docker Compose

1. Minimal Standalone Setup

Copy config.example.json to config.json and launch Pranor Gate:

cp config.example.json config.json
docker run -p 8080:8080 -v ./config.json:/config.json ghcr.io/vyuvaraj/pranor-gate:latest

2. End-to-End AI Gateway + Ollama Setup

Run Pranor Gate connected to a local Ollama LLM endpoint with automatic prompt guard & semantic cache:

docker compose up -d

# Test AI route with automatic prompt guard inspection
curl -X POST http://localhost:8080/ai/v1/chat \
  -H "Content-Type: application/json" \
  -d '{"prompt": "Tell me a joke about distributed systems"}'

Table of Contents

• Key Features
• Performance & Benchmarks
• Configuration & config.example.json
• Command Line & Subcommands
• AI & LLM Gateway
• Security
• Observability
• Enterprise Edition

Key Features

🔀 Reverse Proxy & Routing

• Dynamic path-based routing: Pattern-match prefix rules (e.g. /api/v1/orders/* → http://backend:8081) with automatic URL prefix stripping
• Hot-reload config: Zero-dropped-request configuration reload — update routes, middleware, and targets without restarting
• WebSocket proxy: Full WebSocket upgrade proxying with multi-client stability and load distribution
• Traffic replay engine: Capture and replay live traffic logs (.jsonl) against WASM modules for shadow testing

🧩 WASM & Policy-as-Code

• Sandboxed WASI execution: Compile guest WASM modules to run inline on request/response cycles
• Policy-as-Code Compiler: Compile .policy rule files directly to sandboxed .wasm modules using pranor-gate policy compile

🤖 AI & LLM Gateway (AI-native)

• Prompt Guard: Injection detection & input sanitization (blocks prompt injection attempts before they reach LLMs)
• PII Redaction: Automatically scrub emails, SSNs, and phone numbers from prompts/responses
• Graceful AI Degradation: If no embedding model endpoint is configured, semantic cache gracefully bypasses without returning errors
• MCP Tool Registry: Auto-expose backend services as tools for AI agents

Configuration & config.example.json

Pranor Gate uses a simple JSON configuration. A minimal config.example.json is included in the repository:

{
  "addr": ":8080",
  "auth_token": "gateway-secret-token",
  "routes": [
    {
      "prefix": "/api/v1/services",
      "target": "http://127.0.0.1:8081",
      "middleware": "uppercase",
      "rate_limit_rpm": 120
    },
    {
      "prefix": "/ai/v1",
      "target": "http://127.0.0.1:11434",
      "enable_semantic_cache": true,
      "enable_prompt_guard": true
    }
  ]
}

Command Line & Subcommands

Pranor Gate includes CLI subcommands for shadow traffic testing and policy compilation:

1. Traffic Replay Engine (pranor-gate replay)

Replay historical production traffic logs (.jsonl) against a WASM middleware module to evaluate performance and correctness before deploying:

pranor-gate replay \
  --log traffic_log.jsonl \
  --middleware auth_filter.wasm \
  --output report.json

2. Policy-as-Code Compiler (pranor-gate policy compile)

Compile human-readable API security policy files (.policy) directly into WebAssembly modules:

pranor-gate policy compile rules.policy -o security_rules.wasm

Security

• OAuth2 Bearer token validation per route (JWKS-based)
• WASM sandbox isolation (no host syscall access by default)
• Prompt injection multi-layer detection (pattern matching + ML classifier)
• PII scrubbing before forwarding to external LLMs

Observability

• OpenTelemetry: traceparent propagation on all proxied requests; span per route, per WASM execution
• Prometheus /metrics: request rate, latency histograms, error rates, circuit breaker state, cache hit rates, AI cost counters
• Pranor Console Inspector: Live route table, WASM module management, Swagger UI, AI cost dashboard, prompt guard violation log

Enterprise Edition