Обзор платформы

FlowLink — AI-ориентированная платформа SecOps & Operations — центральный control plane между AI-агентами и вашей инфраструктурой. Не просто шлюз, не просто firewall — полная платформа для безопасных, наблюдаемых и управляемых AI-операций агентов.

Почему FlowLink?

AI-агенты (Claude Code, Cursor, Copilot, Windsurf, custom agents) теперь могут выполнять код, обращаться к базам данных, управлять инфраструктурой и взаимодействовать с API. Без control plane каждый агент — вектор неограниченного эскалации привилегий.

FlowLink находится <strong>inline</strong> между агентами и вашими инструментами, обеспечивая:

Runtime guardrails — real-time command filtering, blocking, and approval
Zero-trust секреты — inject secrets at runtime, never expose to agent memory
Полный аудит-лог — every action logged, timestamped, attributed
Compliance & forensics — incident timelines, compliance reports, state snapshots
Observability — live service map, agent health, anomaly detection

Архитектура платформы

┌──────────────────────────────────────────────────────────────────┐
│                     AI Agents & Coding Tools                      │
│  Claude Code · Cursor · Copilot · Windsurf · Custom Agents       │
└──────────────────────────────┬───────────────────────────────────┘
                               │ MCP / WSS / HTTP
┌──────────────────────────────▼───────────────────────────────────┐
│                      FlowLink Relay                               │
│  ┌──────────┐ ┌──────────┐ ┌───────────┐ ┌──────────────────┐   │
│  │  Shield   │ │  Policy  │ │ Approval  │ │  Rate Limiter    │   │
│  │  Engine   │ │  Engine  │ │  Queue    │ │  & Auth          │   │
│  └──────────┘ └──────────┘ └───────────┘ └──────────────────┘   │
│  ┌──────────┐ ┌──────────┐ ┌───────────┐ ┌──────────────────┐   │
│  │  Secret   │ │  Audit   │ │   SIEM    │ │  Infra Map       │   │
│  │ Injection │ │   Log    │ │ Integration│ │  & Discovery     │   │
│  └──────────┘ └──────────┘ └───────────┘ └──────────────────┘   │
│  ┌──────────┐ ┌──────────┐ ┌───────────┐ ┌──────────────────┐   │
│  │ Forensics│ │ Service  │ │   AI Ops  │ │  Change Mgmt     │   │
│  │ Timeline │ │ Catalog  │ │ Assistant │ │  & Rollback      │   │
│  └──────────┘ └──────────┘ └───────────┘ └──────────────────┘   │
└──────────────────────────────┬───────────────────────────────────┘
                               │
┌──────────────────────────────▼───────────────────────────────────┐
│                    MCP Servers & Infrastructure                    │
│  Git · K8s · PostgreSQL · Redis · Docker · AWS · Vault · SIEM    │
└──────────────────────────────────────────────────────────────────┘

Слои платформы

🛡️ Layer 1: Security & Governance

Компонент	Описание	Статус
Shield Engine	Real-time command filtering — allow, block, or require approval based on pattern matching and risk scoring	✅ GA
Policy Engine	Per-agent, per-service, per-tool policies with priority rules and wildcard support	✅ GA
Approval Queue	Human-in-the-loop approval for high-risk operations — Slack, Telegram, Web UI	✅ GA
Rate Limiting	Per-agent and per-tool rate limits with hot-reloadable configuration	✅ GA
Authentication	OAuth (VK, Yandex, GitHub), email/password, 2FA/TOTP, httpOnly cookie sessions	✅ GA

🔑 Layer 2: Secrets & Zero-Trust

Компонент	Описание	Статус
Secret Injection	Inject secrets at runtime (env vars, files, vault pull) — agents never see credentials	✅ GA
Per-Org Encryption	X25519 key exchange — each organization has unique encryption keys	✅ GA
External Vault	Integration with HashiCorp Vault and other secret backends	✅ GA
Zero-Trust API	Key setup, verification, and rotation endpoints	✅ GA

📋 Layer 3: Audit & Compliance

Компонент	Описание	Статус
Audit Log	Every action logged with agent ID, account ID, timestamp, result, and metadata	✅ GA
Command History	Full command recording with exit codes, duration, shield results, and risk levels	✅ GA
SIEM Integration	Push alerts and events to external SIEM via webhooks (Alertmanager, Generic)	✅ GA
Compliance Reports	Auto-generated security audit and policy compliance reports with scoring	✅ GA
Context Snapshots	Point-in-time state capture for audit, rollback, and post-mortem analysis	✅ GA

🗺️ Layer 4: Infrastructure & Observability

Компонент	Описание	Статус
Infrastructure Map	Semantic graph of hosts, services, databases, queues, and their relationships	✅ GA
Service Discovery	Auto-discover infrastructure via agents (processes, Docker, config files, env vars)	✅ GA
Service Catalog	Live catalog with ownership, SLA tiers, health status, and risk scoring	✅ GA
Agent Health	Real-time agent monitoring with heartbeat tracking and auto-recovery	✅ GA
Incident Timeline	Forensic timeline with blast radius analysis and anomaly detection	✅ GA

🤖 Layer 5: AI Ops & Business

Компонент	Описание	Статус
AI Ops Assistant	Natural language queries about infrastructure, agents, risks, and costs	✅ GA
Efficiency Insights	Agent ROI analysis — time saved, success rates, cost optimization	✅ GA
Change Management	Safe rollout with approval workflow, rollback, and full audit trail	✅ GA
Pattern Learning	Learn agent behavior patterns and auto-generate policy suggestions	🔄 Beta
Cost Attribution	Per-agent, per-service cost tracking and budget alerts	📋 Planned

Alignment с compliance

FlowLink построен в соответствии с emerging AI security standards:

OWASP GenAI MCP Security Guide — tool poisoning prevention, least-privilege access, runtime guardrails
Zero-Trust Architecture — per-org encryption keys, secret injection, no standing credentials
ФСТЭК / ГОСТ Р 57580 — audit logging, access control, incident response (Russian compliance)
SOC 2 Type II — audit trail completeness, access management, change management

Смотрите страницы <a href="/docs/compliance">Compliance</a> и <a href="/docs/fstek">ФСТЭК</a> для детального mapping.

Сравнение с конкурентами

Возможность	FlowLink	ToolHive	Pipelock	Lunar.dev	MCP Defender	Falco	Protect AI
Inline MCP Gateway	✅	✅	✅	✅	✅	✅	❌
Runtime Command Filtering	✅	✅	✅	✅	✅	✅	❌
Human Approval Queue	✅	❌	❌	❌	❌	❌	❌
Zero-Trust Secrets	✅	❌	❌	❌	❌	❌	❌
Infrastructure Map	✅	❌	❌	❌	❌	❌	❌
Forensic Timeline	✅	❌	❌	❌	❌	❌	❌
Service Catalog	✅	❌	❌	❌	❌	❌	❌
AI Ops Assistant	✅	❌	❌	❌	❌	❌	❌
Self-hosted / On-premise	✅	✅	✅	✅	✅	✅	❌
ФСТЭК Compliance	✅	❌	❌	❌	❌	❌	❌

Technology Stack

Backend: Rust (Tokio, Axum, SQLx, Teloxide)
Frontend: Next.js 15 (App Router, Server Components, Tailwind CSS)
Database: PostgreSQL (Supabase-compatible)
Agent Protocol: MCP (Model Context Protocol) over WebSocket / HTTP
Crypto: X25519 + AES-256-GCM for zero-trust encryption
Infrastructure: Docker, systemd, nginx reverse proxy