# Burgus Security — full product reference

> Enterprise AI security for LLM and MCP agent traffic. On-premise and private cloud. GDPR-aligned. NIS2-ready exports. Active blocking. BYOK.

Short summary: https://burgus.ai/llms.txt
Machine index: https://burgus.ai/.well-known/agent-index.json
Contact form: https://burgus.ai/#contact
Email: hi@burgus.ai

---

## What Burgus Security is

Burgus secures production AI agents and the data they connect to:

1. **LLM API traffic** — active blocking, security alerts, behavioral signals, audit on model calls
2. **MCP data connections** — tool ingress/egress, access control, audit
3. **Multi-agent collaboration** — graphs, combined reports, compliance exports
4. **Provider choice (BYOK)** — keep direct relationships with any supported model or MCP source

**Deployment:** Licensed for on-premise and private-cloud installation. Website terms (site only, not product): https://burgus.ai/terms/

---

## Primary URLs

| Surface | URL |
|---------|-----|
| Website | https://burgus.ai/ |
| Contact form | https://burgus.ai/#contact |
| Email | hi@burgus.ai |
| Integration | https://burgus.ai/agent-access/ |
| Compliance (GDPR & NIS2) | https://burgus.ai/compliance/ |
| Platform API | https://burgus.ai/api/ |
| LLM data plane | `https://{provider}.securellm.{your-domain}` |
| MCP data plane | `https://{source}.mcpdata.{your-domain}` |
| Agent index (JSON) | https://burgus.ai/.well-known/agent-index.json |
| API catalog (RFC 9727) | https://burgus.ai/.well-known/api-catalog |
| Sitemap | https://burgus.ai/sitemap.xml |
| llms.txt (short) | https://burgus.ai/llms.txt |

### Topic landing pages

- Multi-agent security: https://burgus.ai/multi-agent-security/
- Behavioral analysis: https://burgus.ai/behavioral-analysis/

---

## Governance & compliance

### GDPR

- Deploy in your environment — platform, audit store, and exports stay on infrastructure you operate
- Metadata-first audit by default (timestamps, vendor, status, correlation — not full prompt bodies)
- Exportable audit and alert history for accountability, DPIAs, and records of processing
- Your organisation configures tenant scope and remains responsible for lawful basis in your deployment context

### NIS2

- Alert timelines for detection and internal escalation
- JSON/CSV export bundles for CSIRT review and incident evidence prep
- Multi-agent traceability — delegation graphs and burst timelines
- No dependency on external SaaS control plane for day-to-day security layer operation

Full detail: https://burgus.ai/compliance/

---

## Data plane (security layer)

Point your existing provider SDK at Burgus secure hostnames on your deployment. Wire format and upstream auth stay identical.

- Example pattern: `https://{provider}.securellm.{your-domain}`
- List assigned hostnames via operator MCP or REST
- Register upstream keys via operator MCP or REST (secrets never returned in full — prefixes only)

### Optional correlation headers (enhanced traceability)

| Header | Purpose |
|--------|---------|
| `X-Llmproxy-Session-Id` | Shared conversation id across agents |
| `X-Llmproxy-Workflow-Id` | Groups related steps in a job |
| `X-Llmproxy-Agent-Id` | Identifies which agent made the call |
| `X-Llmproxy-Agent-Role` | Role label (orchestrator, worker, critic, …) |
| `X-Llmproxy-Parent-Request-Id` | Links child call to prior request id |

Response header `X-Llmproxy-Request-Id` is returned on every secured call for audit linking.

---

## Authentication

| Layer | Method |
|-------|--------|
| Operator MCP / REST | Burgus API key issued during deployment (`Authorization: Bearer burgus_*`) |
| Security layer | Your upstream provider API key (native provider auth on secure hostnames) |

---

## Operator MCP (control plane)

Programmatic operations on your deployment:

- **Tenant & keys** — profile, API keys, upstream keys, secure endpoints
- **Access** — MCP credentials, connection access config, agent/workflow allowlists
- **Policies & alerts** — content policy, delivery settings, platform and behavioral reports
- **Audit** — events, sessions, workflows, multi-agent graphs, export bundles

Endpoint hostname is assigned during deployment (not a shared public SaaS URL).

---

## Security enforcement

Burgus actively blocks production traffic that matches configured platform rules, content policy, and behavioral enforcement settings. Every block is logged with audit metadata and alert history.

Coverage includes credentials in prompts, injection patterns, content policy hits, behavioral anomalies, and multi-agent abuse signals — mapped to OWASP LLM Top 10 and MITRE ATLAS where applicable.

---

## Compliance exports

Export surfaces via operator MCP and REST on your deployment:

- Customer compliance snapshot
- JSON or CSV export bundles
- Content-policy alert export with approval audit trail
- Platform coverage and behavioral full reports
- Combined multi-agent security report

Topic page: https://burgus.ai/compliance/

---

## Integration workflow

1. License Burgus for your organisation
2. Deploy the platform in your VPC or private cloud
3. Create operator API keys on your deployment
4. Register upstream LLM and MCP credentials; configure Access policies
5. Route production agent traffic through assigned hostnames; configure blocking policies
6. Review blocks, alerts, and exports via operator MCP or REST

Contact: https://burgus.ai/#contact or hi@burgus.ai