Published
semgate asks Jev about each HTTP request, then a live range to attack it
mizutani published semgate, a Go net/http middleware that sends each request to Jev as typed questions and lets your function block, route, or pass. A companion range, Injection Range, is up on Cloud Run. Default configuration sends every header, including Authorization and Cookie, unless you denylist them.
mizutani posted on September 20 that he had written a Go middleware to judge HTTP requests with Jev, and a CTF-style site to try it against. The library is m-mizutani/semgate. The range is m-mizutani/semgate-example, live at the Cloud Run URL in the post.
semgate wraps net/http. You pass a TypeSafe client (default model jev-latest) and get middlewares: g.Noul, g.Choice, g.Score, or g.Ask for several questions in one call. Your function sees the typed answer and decides whether to call next, answer itself (block), or hand the request to another handler (route). chi Use / With works because the type is func(http.Handler) http.Handler. Routes that need no evaluation stay outside the group, or you pay for an API call on every request.
By default every header and query parameter is sent to TypeSafe, including Authorization and Cookie. WithHeaderDenylist / WithHeaderAllowlist (and the query equivalents) are how you stop that. The example range denylists Authorization, Proxy-Authorization, and Cookie. Body is sent only for listed content types, default 16 KiB, truncated. If the API call fails, the default handler answers 503 and does not call your function. The range goes further: an unevaluated request is not forwarded.
Injection Range is a single binary that looks like a vulnerable app. Six /api sinks (login SQLi, ping command injection, files path traversal, greet SSTI, fetch SSRF, track Log4Shell) parse input inside a model of the sink and return synthetic data. There is no database write, no shell, no filesystem, no outbound fetch from the handlers. A request that reaches a handler is always 200; exploited is a flag. With a TypeSafe key, NewGuard asks one Noul, “does this request carry an attack payload?”, with a long list of techniques and a note that O'Brien is not an attack. Default threshold 0.8. At or above, 403. TestGuardLive requires each attack payload to be 403 and each benign request to reach the handler, and only runs when TEST_TYPESAFE_API_KEY is set. The post says the live site is fair game; if something actually breaks, tell the author privately.
This is the same route-the-expensive-call pattern as Hono’s semantic router, on Go, with a public range attached. We did not send traffic to it.
This site's reading
Editorial notes evaluating claims against primary sources, contextualizing findings alongside related implementations, and defining technical terms.
Verify
The September 20 post points at github.com/m-mizutani/semgate and a Cloud Run URL. A follow-up points at guard.go lines 63-80 in semgate-example and says attacks are simulated, with no real injection. semgate is Apache 2.0 Go middleware over net/http. Default model jev-latest. By default every request header and query parameter is sent to TypeSafe, including Authorization and Cookie; WithHeaderDenylist is how you stop that. The example denylists Authorization, Proxy-Authorization, and Cookie. Evaluation failure answers 503 by default; the range fail-closes (does not forward). TestGuardLive, when TEST_TYPESAFE_API_KEY is set, requires each attack payload to get 403 and each benign request to reach the handler. The range exposes six /api sinks (SQLi, command injection, path traversal, SSTI, SSRF, Log4Shell) that parse input in a model of the sink and return synthetic data. Guard threshold default 0.8. We did not send traffic to the live URL.
Compare
Hono's semantic router also sends request metadata to Jev and branches on a threshold. Yusuke redacts Authorization and Cookie in that demo and warns against using the match for authentication. semgate's README makes the same header leak the default, then documents the denylist. Kumar's reject filter sits in front of a classifier; this sits in front of an HTTP handler. LangChain's AutoModeMiddleware can refuse a tool call. None of those is a public range with six simulated sinks. The live site has no published catch rate.
Terms
- semgate
- mizutani's Go net/http middleware. It asks Jev typed questions about an incoming request and hands the answers to your function, which may block, route, or call next.
- Injection Range
- semgate-example, a Cloud Run service with six simulated injection sinks. With a TypeSafe key the guard answers 403; without a key every payload reaches the handler. No real side effects.
- Header denylist
- semgate.WithHeaderDenylist. Without it, Authorization and Cookie are sent to TypeSafe with the rest of the request.