AuthFI Agent

One binary.
Protects everything.

One DaemonSet or systemd service. eBPF kernel enforcement + WireGuard encrypted mesh + HTTP proxy fallback + auto service discovery + infrastructure audit. Deploy once — it handles the rest.

How it works

Deploy the agent. It discovers your services, observes traffic, learns your API routes. You create policy. eBPF enforces. Five steps. Zero code changes.

🚀 DEPLOY kubectl apply

🛡️ AGENT DaemonSet starts

🔍 DISCOVER 24 services, 47 pods

📊 OBSERVE traffic patterns

⚡ ENFORCE eBPF ~45μs

🚀 DEPLOY kubectl apply

🛡️ AGENT DaemonSet starts

🔍 DISCOVER 24 services, 47 pods

📊 OBSERVE traffic patterns

⚡ ENFORCE eBPF ~45μs

Deploy

One DaemonSet. That's it.

$ kubectl apply -f authfi-agent.yaml

✓ daemonset.apps/authfi-agent created
✓ Running on 2/2 nodes

Agent auto-discovers services

No config needed. Reads /proc/net/tcp on VMs, watches K8s API on clusters.

✓ patient-api:8080  (K8s, ayush-patient-service)
✓ admin:3000        (K8s, ayush-admin)
✓ postgres:5432     (K8s, ayush-infra)
✓ redis:6379        (Docker container)

Agent observes live traffic

Learns API routes, request patterns, who accesses what.

Discovered APIs — patient-api:8080

GET  /api/patients      → 847 hits/day  (doctors, nurses)
POST /api/prescriptions → 124 hits/day  (doctors only)
DELETE /api/records     → 3 hits/day    (admin only)

Create policy

Natural language or manual. Either way, eBPF enforces at kernel level.

NL: "Only doctors can access patient records"

→ Translates to:
GET /api/patients/* roles: [doctor]
POST /api/patients/* roles: [doctor] MFA: required

→ eBPF enforces at kernel level, ~45μs

Protected. Zero code changes.

Your app never sees unauthorized requests. Every decision logged.

~45μs

enforcement latency

code changes

100%

requests audited

What is eBPF?

eBPF lets you run sandboxed programs inside the Linux kernel. AuthFI uses it to intercept network packets and validate identity before they reach your application — at kernel speed, with zero overhead.

How a request flows through the kernel: HTTP Request (with JWT in Authorization header) │ ▼ ┌─────────────────────────────────┐ │ Linux Kernel │ │ │ │ eBPF Program (AuthFI) │ │ │ │ │ ├── Parse HTTP headers │ ~5μs │ ├── Extract JWT │ ~10μs │ ├── Verify signature (JWKS) │ ~20μs │ ├── Check roles/permissions │ ~5μs │ ├── Check MFA if required │ ~2μs │ │ │ │ ├── ALLOW → forward to app │ ~45μs total │ └── DENY → return 401/403 │ │ │ └─────────────────────────────────┘ │ ▼ Your Application (untouched) // Your app never sees unauthorized requests. // Zero code changes. Zero latency overhead.

WireGuard Mesh

Every agent automatically joins an encrypted mesh network. Peer-to-peer WireGuard tunnels between all your hosts — identity-aware, NAT-traversing, no VPN appliance needed.

Encrypted peer-to-peer tunnels

Every agent establishes WireGuard tunnels to every other agent. All inter-service traffic is encrypted end-to-end. No central VPN gateway bottleneck.

node-01 ←──WG──→ node-02
node-01 ←──WG──→ node-03
node-02 ←──WG──→ node-03
// Full mesh. Every link encrypted.

Identity-aware routing

Not just network-level access. The mesh carries identity context — AuthFI JWT claims are available at every hop. Policies follow the user, not the IP.

request → mesh tunnel → identity preserved
// roles, groups, MFA status travel with the request

NAT traversal

Works across data centers, cloud regions, and home offices. WireGuard handles NAT punching automatically. No static IPs or port forwarding needed.

No VPN needed

Replace your VPN with identity-aware mesh. Users authenticate with AuthFI — the agent handles the encrypted tunnel. No VPN client, no VPN appliance, no split tunneling headaches.

Infrastructure Audit

The agent continuously audits your infrastructure. Detects misconfigurations, security risks, and compliance violations. Produces a security posture score per host.

📦

K8s Pod Audit

Detects privileged containers, hostNetwork, hostPID, missing resource limits, containers running as root, missing security contexts.

🐳

Container Audit

Scans Docker containers for exposed ports, privileged mode, root user, missing health checks, outdated base images, mounted sensitive paths.

🖥️

VM Process Audit

Lists listening processes, open ports, root services, missing network policies. Identifies unexpected listeners and shadow IT services.

Infrastructure Audit — node-01 (ah-bm-ctc-01) FINDING SEVERITY STATUS Privileged container: monitoring CRITICAL FAIL Container running as root: jenkins HIGH FAIL No network policy: ayush-patient MEDIUM WARN Open port 6379 (no auth): redis MEDIUM WARN Resource limits set: patient-api LOW PASS Non-root container: admin-panel LOW PASS Security Posture Score: 62/100 (2 critical, 2 warnings)

Architecture

📡

Control Plane

AuthFI API manages policies, JWKS keys, and agent configuration. Agents poll for updates using ETags — changes propagate in <30 seconds.

🤖

Agent (per host)

Single binary. Discovers services, loads eBPF programs, establishes WireGuard mesh, runs infrastructure audit, syncs policies, reports access decisions. Runs as systemd service or DaemonSet.

⚡

eBPF (in kernel)

Sandboxed program in the kernel's network stack. Validates JWT, checks policies, allows or blocks — all before packets reach userspace.

Setup in 3 steps

Install the agent

$ curl -sSL https://get.authfi.app/agent | sh

✓ Agent installed to /usr/local/bin/authfi-agent
✓ Systemd service created

$ AUTHFI_TENANT=acme AUTHFI_AGENT_TOKEN=as_xxx authfi-agent

Services auto-discovered

✓ Discovered 8 services:

:3000 node admin-panel
:3001 grafana monitoring
:8080 myapi patient-api
:8081 myapi imaging-api
:8082 myapi billing-api
:8888 java jenkins
:5432 postgres database
:6379 redis cache

On Linux: reads /proc/net/tcp. On Kubernetes: watches the K8s API for Services and Pods.

Create a policy

Policy: "Patient API Protection" Port: 8080 | Mode: enforce | Default: deny Rules: ✓ GET /api/patients/* roles: [doctor, nurse] ✓ POST /api/patients/*/notes roles: [doctor] MFA: required ✓ GET /health (public — no auth) ✗ Everything else DENIED

Granular policy control

Route-level rules

Match HTTP method + path pattern. Protect specific endpoints, not just ports.

GET /api/patients/* roles: [doctor, nurse]
POST /api/patients/* roles: [doctor]

MFA enforcement per route

Sensitive operations require MFA verification. The JWT must contain mfa_verified: true.

DELETE /api/patients/:id
roles: [admin] require_mfa: true

Group-based access

Require group membership. Combined with roles and permissions for fine-grained control.

POST /api/deploy/*
required_groups: [devops]

Monitor or enforce

Start in monitor mode to observe traffic. Switch to enforce when confident.

mode: monitor → log only
mode: enforce → block unauthorized

Monitor first. Enforce when ready.

Monitor Mode

Log all decisions but never block. See who's accessing what before you enforce.

→ See all traffic patterns
→ Discover required permissions
→ Test policies safely
→ Zero risk of breaking production

Enforce Mode

Block unauthorized requests at the kernel. Returns 401/403 before your app sees the request.

→ Unauthorized requests never reach your app
→ MFA enforced per route
→ Every decision logged with latency
→ ~45μs overhead (kernel-level)

Automatic API discovery

The agent observes traffic and discovers API endpoints automatically. Know exactly which routes exist before writing policies.

Discovered APIs — patient-api:8080 METHOD PATTERN HITS POLICY GET /api/patients 1,547 ✓ protected POST /api/patients 234 ✓ protected GET /api/patients/:id 8,921 ✓ protected POST /api/patients/:id/notes 456 ✓ protected (MFA) DELETE /api/patients/:id 12 ✗ no policy GET /health 42,000 public GET /metrics 41,998 ✗ no policy

Real-time access logs

Every access decision is logged with who, what, when, from where, and how fast.

TIME	USER	REQUEST	DECISION	LATENCY
10:30:05	alice@acme.com	GET /api/patients/123	allow	45μs
10:30:06	alice@acme.com	POST /api/patients/123/notes	allow	52μs
10:31:00	bob@acme.com	DELETE /api/patients/456	deny	12μs
10:31:02	(no token)	GET /api/patients	deny	8μs
10:31:05	charlie@acme.com	POST /api/admin/settings	deny	15μs

Works everywhere

Linux (eBPF)

Kernel-level interception. ~45μs latency. Zero overhead. Requires kernel 5.4+.

Ubuntu Debian RHEL Amazon Linux

Kubernetes

DaemonSet deployment. Auto-discovers Services, Pods, Endpoints. Namespace-aware policies.

EKS GKE AKS OKE

HTTP Proxy (fallback)

For non-Linux or older kernels. Reverse proxy mode with JWT validation. Injects user headers.

Docker VMs macOS dev

vs. other approaches

	AuthFI Agent	Istio	Envoy Sidecar	Nginx Auth
Code changes	None	None	Sidecar config	Auth module
Latency overhead	~45μs	~2ms	~1ms	~500μs
Service discovery	Automatic	K8s only	Manual	Manual
API discovery	Automatic	—	—	—
Identity source	AuthFI JWT	mTLS certs	JWT/mTLS	JWT
Policy management	Dashboard + API	YAML	YAML	Config files
MFA per route	Yes	—	—	—
WireGuard mesh	Built-in	—	—	—
Infra audit	Built-in	—	—	—
Audit trail	Built-in	External	External	Log parsing
Non-K8s support	Yes (VMs, Docker)	No	Partial	Yes

One platform. Every identity layer.
Free to start.

Free for 5,000 users. Upgrade when you're ready.

Start building free →

Startups and enterprises get 1 year free →

One binary.Protects everything.

How it works

Deploy

Agent auto-discovers services

Agent observes live traffic

Create policy

Protected. Zero code changes.

What is eBPF?

WireGuard Mesh

Encrypted peer-to-peer tunnels

Identity-aware routing

NAT traversal

No VPN needed

Infrastructure Audit

K8s Pod Audit

Container Audit

VM Process Audit

Architecture

Control Plane

Agent (per host)

eBPF (in kernel)

Setup in 3 steps

Install the agent

Services auto-discovered

Create a policy

Granular policy control

Route-level rules

MFA enforcement per route

Group-based access

Monitor or enforce

Monitor first. Enforce when ready.

Monitor Mode

Enforce Mode

Automatic API discovery

Real-time access logs

Works everywhere

Linux (eBPF)

Kubernetes

HTTP Proxy (fallback)

vs. other approaches

Related features

Multi-AuthFI Connect

Control Plane

AI Security

One platform. Every identity layer. Free to start.

One binary.
Protects everything.

One platform. Every identity layer.
Free to start.