Alexander Romanov

I built an MCP security gateway. Then I found the attack every layer allowed.

Sun, 19 Jul 2026 00:00:00 +0000

I implemented identity, policy, credential injection, audit and isolation for an MCP gateway—then traced the two-call attack those controls could authorize correctly and still lose to.

AI agents are talking to everything. Nobody agreed on who can ask.

Sun, 28 Jun 2026 00:00:00 +0000

MCP makes connecting AI agents to tools so easy that the governance question arrives after the connections are live. Part 1 of a series on MCP security — the structural problem: there's no single place to ask whether a tool call should happen.

Mediate, don't classify: the design of a runtime MCP security gateway

Sun, 28 Jun 2026 00:00:00 +0000

How a runtime gateway mediates every AI-agent tool call — one port, six checks, per-identity profiles, and credentials the agent never holds. Part 2 of a series on MCP security.

About

Mon, 01 Jan 0001 00:00:00 +0000

I’m Alexander Romanov — a cyber defence practitioner.

I came up through red-team work and now lead security operations: detection engineering, threat hunting, incident response, and the architecture that holds them together. I work the defender’s side of the board, using the attacker’s perspective to build capability that actually catches things — the point of knowing how things break is being there when they do.

This site is where I write about that work — purple teaming, detection and response, secure architecture, and the open-source tools I build — and where I think out loud about where the threat model is heading, including the new attack surface that AI agents are opening up. That’s one lane of the work, not the whole of it.