API SECURITY / EARLY ACCESS · Every identity. Every route. A clear decision.
Tucana Shield
Explore the demo
◈ TUCANA SHIELD / API DEFENSE

API SECURITY / MISSION CONTROL

A deliberate stack.
Every component has a boundary.

Keep inline request decisions separate from the asynchronous evidence pipeline. Click a component for its role, prerequisites and limitations.

API-FIRSTHUMAN AUTHORITYDEFINED BOUNDARIES
THE CONNECTED SYSTEMILLUSTRATIVE MISSION DISPLAY
TUCANA / CONTROL ROOM
CONTEXT → DECISION → EVIDENCE
Request path / evidence pathOne connected view. A specific scope for every control.
MISSION CONSOLE / ARCHITECTUREExplore a sample ↗
LIVE CONNECTION STATUSREAL SERVICE CHECKS · NO CUSTOMER RECORDS
CONNECTING

Current service health

Loading the latest read-only checks…

Waiting for a timestamped observation
Customer workspace—Check duration unavailable
Pilot inquiry service—Check duration unavailable
Recent service checks
Only actual observations appear here.
Health checks describe these services. Customer API request and blocked-attack counters are not connected.Open Grafana ↗
CONTROL ROOM / API SECURITYSCOPED IDENTITYTRACEABLE DECISIONSKnow the evidence ↗
ARCHITECTURE / TWO ACCOUNTABLE PATHSREFERENCE VIEW · CONNECTION STATUS IS EXPLICIT
REQUEST PATH / SYNCHRONOUSA decision before an application effect
EVIDENCE PATH / ASYNCHRONOUSEvidence never grants permission
Compatible gateway + application controls + bounded evidence. Deployment is verified per environment.Component dossiers ↗

01 / ENVIRONMENT-DEPENDENT

Cilium

Network context and enforcement

eBPF networking, Hubble flow visibility and network policy in supported deployments. Kernel flows do not reveal encrypted request bodies or business-level object ownership.

Network flowidentity contextreviewed network policy
Apache-2.0 coreRead integration details ↗

02 / INTEGRATION TARGET

Redpanda

Asynchronous event transport

A Kafka-compatible transport for structured request observations and decision events. It buffers telemetry; it does not sit in the application authorization decision.

Minimized eventtopicbounded consumer
Source-available core; terms vary by featureRead integration details ↗

03 / INTEGRATION TARGET

ClickHouse

API evidence analytics

Column-oriented analytics for request metadata, route changes and policy results. Application queries still need tenant isolation and bounded time ranges.

Versioned eventtenant-scoped tableevidence query
Apache-2.0 coreRead integration details ↗

04 / INTEGRATION / STAGED

Akto

API discovery and security testing

Akto is the selected discovery and testing integration. Its open-source inventory and API test workflow complement Tucana Shield application authorization and request evidence.

Sanitized observationsAPI inventoryscoped security tests
MIT core; hosted and enterprise terms differRead integration details ↗

05 / LAB PREVENTION VERIFIED / PRODUCTION STAGED

open-appsec

Inline request inspection

The isolated NGINX lab verified basic-model prevention: SQL injection, cross-site scripting and shell-injection probes returned 403 before the origin. The nine-check lab was removed after testing. Customer production prevention is staged; authentication and object authorization remain application decisions.

NGINX attachmentcontextual inspectionapp authorization
Apache-2.0 engine/basic model; separate advanced-model termsRead integration details ↗
INTERNAL PROTECTION BASELINERETAINED / SEPARATE SCOPE

Protect the platform underneath.

Endpoint inventory, host monitoring, network context and on-demand investigation remain internal supporting capabilities. They are no longer marketed as six separate customer protection packages.

osquery ↗Wazuh ↗Velociraptor ↗Microsoft Defender ↗ScubaGear ↗Maester ↗Prowler ↗Suricata + Zeek ↗Vector ↗Sigma + YARA-X ↗
YOUR NEXT MOVESCOPE BEFORE ENFORCEMENT

START WITH ONE API

Make the boundary visible.
Then prove the control works.

Bring your gateway, an API contract and a test environment. Define the evidence, owners and response limits for a scoped pilot.

Scope an API pilotExplore the request lab