Mayhem Shield publishes its methodology and points to related public technical work that makes the underlying security and assurance thinking inspectable before an engagement.
The Mayhem Shield Framework is an official practice resource. The projects maintained under the tgandhle GitHub account are related open-source work by members of the team. They are not client deliverables, product warranties, or evidence that a control is operating in a specific deployment.
Official methodology
Public methodology structure, implementation categories, capability overlays, evidence expectations, approval gates, and public-safe templates for buyer-side AI implementation assurance.
View the framework on GitHub →These projects cover adjacent parts of the same problem: how APIs, agents, MCP servers, credentials, and vendor data commitments are reviewed and constrained in practice.
Interactive reference
Interactive guides to HTTP API security and modern authentication and authorization protocols, including OAuth, OpenID Connect, mTLS, DPoP, FAPI, MCP authorization, and AI-specific API risks.
Reference material for design reviews and learning, not a substitute for a system-specific threat model.
Reference implementation
An OAuth and JWT-enforcing reverse proxy for MCP servers. It verifies tokens, applies method scopes and optional claim-bound tool authorization, filters tool discovery, and emits structured audit events.
Production use still requires deployment-specific issuer, TLS, workload identity, logging, readiness, and incident-ownership validation.
Security reference runtime
A security-first Python agent runtime exploring capability-enforced authorization, broker-controlled credential use, trusted execution boundaries, and adversarial security testing.
Approval is currently classified and blocked, not implemented as a complete authenticated pause, approval, and resume workflow.
Procurement toolkit
Open questionnaires, DPA clause examples, scoring tools, and red-flag guidance for assessing how SaaS vendors may train on, derive from, or otherwise use customer data.
A contract and governance aid, not technical verification of vendor behavior or legal advice.
