Insights, integration guides, and updates from the Bifrost team.
JFrog Security Research recently disclosed two vulnerabilities in Bifrost's management API. They can only be exploited when both of these are true: the instance is exposed to the internet, and dashboard authentication has not been set up. Both are fixed in transports/v2.1.0
Bifrost now supports TypeSafe's jev judgment models behind a unified POST /v1/decisions endpoint and a 1:1 /typesafe drop-in for TypeSafe's official SDKs. This is available in v2.2.2 for both OSS and Enterprise. TypeSafe's jev family takes a piece of state - a support ticket, a model's answer, a review, any string or JSON blob - and returns calibrated judgments: a probability, a pick from your options, or a rubric score, each with confidence and a full probability distribution. That makes them
Introduction MCP gives AI applications something more powerful than a prompt and a response. It gives them access to tools. An agent can search internal systems, create tickets, query databases, send messages, and work with third-party services. That is useful, but it also changes the security problem. The risk is not only that a model generates unsafe text. The risk is that unsafe or sensitive input becomes a real action in another system. This is where MCP guardrails matter. In Bifrost, MCP
Today we are releasing Bifrost v2.0, the largest release we have shipped. A year ago we open sourced Bifrost with one belief: a gateway only earns the right to sit in front of every AI request if it is performant and resilient at scale. Bifrost now runs in production at Fortune 500 companies across financial services, healthcare, technology, pharma and defense, moving trillions of tokens a day. We also realized that most of an organization's AI traffic never reaches the gateway at all, because
Most teams that run AI in production eventually get the same question from finance. Spending went up last month, and someone wants to know which team, feature, or model caused it. Often there is no clear answer. The numbers exist, but they sit in two systems that were never built to share data. This is a design problem, not a sign that anyone was careless. Often a team builds its metrics pipeline and its budgeting system at different times, owned by different people. One tracks requests and tok
Introduction AI costs at enterprises can become expensive quickly. Recent examples show this clearly - Uber reportedly exhausted its annual AI budget only four months into 2026, while Pylon’s CEO said the company’s Anthropic bill was set to jump from $400K to $1.4M a year after crossing 150 seats. These are different companies at different scales, but the pattern is similar: once AI usage becomes normal across teams, cost control becomes an operational problem, not just a pricing problem. Most
The most damaging data leak in your organization this year probably won't come from an attacker. It'll come from an employee trying to hit a deadline. Right now, across nearly every company, people are pasting source code, customer records, contracts, and clinical notes into AI tools that security never approved, can't see, and can't audit, and most of it leaves no trace in the logs you actually watch. We called the last version of this problem shadow IT. This one is worse, and the gap between h
LLM features started out as text in, text out. They have not been that for a while. A support tool ingests a screenshot of a customer's account dashboard with billing details visible on screen. A document agent reads a vendor PDF where the malicious instructions live inside an embedded image, not in the text the model sees. A receipt-processing assistant accepts a photo of an invoice that includes a full credit card number. A vision-enabled medical tool gets handed a chart image with a patient's
Most AI security tooling is built around a binary: a prompt is either allowed through or rejected. That works for an obvious attack, but it is a blunt instrument for the situation enterprises actually hit most often, which is legitimate work that happens to carry sensitive data. A support agent pastes a customer's full record into a summarization tool because summarizing it is the job. A developer drops a stack trace with a live token into a debugging assistant. An analyst feeds a spreadsheet of
MCP adoption inside enterprise AI stacks moved from a single experimental server to fleets of tools wired into production agents in a remarkably short window. As that surface area expanded, three questions stopped being theoretical for platform teams: which tools is an agent allowed to call, who triggered any given call, and what arguments and results moved through it. Bifrost addresses those questions at the gateway layer with a first-class MCP audit log that captures every tool execution, the
LLM features in production fail in ways that classic guardrails are not looking for. A coding assistant returns JSON that looks valid and silently breaks the downstream pipeline that parses it. A customer support reply apologizes three times in five sentences and reads as defensive. A marketing draft names a competitor in a comparison the brand team never approved. An HR assistant writes advice in subtly gendered language. An internal tool answers a perfectly reasonable question with "As an AI a
See how Bifrost and CrowdStrike AIDR secure enterprise LLM traffic: AIDR handles detection, Bifrost enforces policy inline before any prompt reaches a model. Enterprise AI deployments run into the same set of security issues within a few months of going live. A support rep pastes a full customer record into a summarization tool, and the prompt leaves your network for a third-party API with its own retention policy. A retrieval agent ingests a vendor PDF with instructions hidden in white-on-whit