Behavioral · automatic learning

Spot when agent behavior changes

Burgus learns normal activity from your production traffic and can block or alert when something looks unusual — based on your policy configuration.

Three phases of automatic learning

Burgus behavioral analysis runs on audit metadata from LLM and MCP traffic that Burgus protects in production.

Phase 1 — baseline and graph signals

• Volume, error rate, and usage spikes vs rolling 7-day baselines
• Workflow fan-out, loop suspects, and novel vendor appearance
• Realtime queue ingest plus hourly batch re-analysis

Phase 2 — similarity matching

• Lightweight similarity detection on audit traffic
• Near-duplicate bursts and cross-agent template abuse
• Centroid drift vs learned norms

Phase 3 — clustering

• Agent outliers, coordinated burst incidents, novel graph topology
• Hub emergence and multi-agent coordination signals
• Automatic behavioral learning across all three phases

Production-friendly by design

Behavioral matching supports active blocking and alerting. Burgus can block anomalous traffic when your policy requires it, with explain payloads for every match — built for high-volume agent workloads.

Operator MCP and REST reporting

Behavior alert catalogs, summaries, timelines, and full reports are available via operator MCP and REST, including behavior sections inside the combined multi-agent security report. Platform API →