Documentation

MAF is an AI-assisted backend security service that validates every incoming request at the application layer.

In modern web architecture, backend requests cannot be trusted blindly. Traditional WAFs operate at the network edge but often lack context about the application's internal logic or user session state.

MAF solves this by sitting closer to your application logic (or continuously communicating with it), preventing session abuse, device spoofing, malicious payloads, API abuse, automation attacks, and insider misuse.

High-Level Request Flow

When a request hits your backend (via our middleware or SDK), MAF intercepts it to perform real-time analysis before any business logic is executed.

• Signal Extraction: We extract high-fidelity signals from the request metadata, headers, device fingerprint, and behavioral patterns.
• Session Validation: Depending on configuration, we validate the continuity of the session against known history.
• Risk Scoring: A deterministic score is calculated based on active rules. If the score exceeds a threshold, AI agents can be optionally engaged for deeper analysis.
• Enforcement: MAF returns a decision: ALLOW, BLOCK, or DROP_SESSION.

The architecture is rules-first, AI-optional. This ensures millisecond-latency for 99% of requests, with AI only stepping in for high-risk anomalies.

MAF is designed to be unobtrusive yet powerful. The system consists of three main components:

1. Middleware / SDK: Sits in your API service (e.g., Express, Fastify, Next.js). It forwards metadata to the MAF Engine.
2. MAF Engine: The core decision maker. Uses Redis for hot session state and fast rule lookups.
3. Audit Layer: Postgres stores detailed logs for every request. An optional Blockchain Anchor service provides immutable proof of logs for compliance.

Note: The AI Adapter is an isolated service that is only invoked when deterministic rules flag a potential, but unconfirmed, threat.

Installation

npm install mafai

We prioritize a developer-friendly integration process. Currently, we support Node.js environments with first-party middleware for common frameworks.

const express = require('express');
const { mafaiExpress } = require('mafai');

const app = express();

app.use(express.json());

app.use(mafaiExpress({
    apiKey: "YOUR_MAF_APP_KEY",
    engineUrl: "http://your-engine-ip:3001/evaluate"
}));

Typical rollout strategy:

• Day 1: Integrate Monitor Mode. No user impact.
• Day 2-3: Tune rules based on dashboard insights.
• Day 4: Switch to Block Mode for high-confidence rules.

MAF operates in one of three modes, configurable per-environment or per-route.

The dashboard is a standalone application that runs on a separate port (local dev) or hosted cloud URL (prod).

• Live Feed: Watch requests come in real-time with risk scores.
• Attack Replay: Re-run a past request against current rules to see if it would still be blocked.
• Forensics: Deep dive into specific blocked requests to see exactly why they were flagged (e.g., "User Agent mismatch + High Velocity").

MAF's architecture is built upon cutting-edge research in web security and behavioral analysis. We actively monitor academic developments to ensure our defenses stay ahead of novel evasion techniques.