Enterprise AI · Cloud Architecture · AI-Agent Security Research

Gowthaman Arumugam

AI Architect & Enterprise Solutions Architect

Technology leader with 13+ years architecting large-scale, cloud-native and AI-powered platforms for regulated industries — and an independent researcher building open-source defenses and benchmarks for the AI-agent (MCP) ecosystem. I translate business priorities into secure, compliant, measurable architecture.

Explore the Research Enterprise Track Record Get in Touch

13+: years in enterprise architecture
32: MCP attack vectors benchmarked & mapped to 7 frameworks
62%: measured attack-surface coverage — broadest of any tool on the public leaderboard
9: large-scale enterprise platforms delivered

About

Architecture as a discipline of trust

I operate at the intersection of two demanding disciplines. As an enterprise architect, I have spent over a decade designing and delivering mission-critical platforms — mortgage origination systems, payment processing, multi-tenant SaaS, real-time data streaming — for clients in banking, financial services, and global manufacturing. As an AI architect and security researcher, I design the guardrails that let organizations adopt AI agents with confidence: runtime defenses, governance frameworks, and open benchmarks mapped to the standards regulators actually use (NIST AI RMF, NSA MCP guidance, OWASP).

The through-line is the same in both: an architecture is only as good as what it can prove. Provable availability, provable compliance, provable security coverage. That conviction shaped a research program whose central artifact is the first open, vendor-neutral benchmark of MCP defensive tooling — and a security proxy that the benchmark itself drove from 9% to 62% measured coverage, then held to account with a pre-registered held-out test set.

Architecture Practice

Two complementary disciplines, one standard of rigor

AI & Generative AI Architecture

Enterprise GenAI strategy → governed production platforms

GenAI platforms & LLM integration — Azure OpenAI, Copilot Studio, RAG patterns, MCP servers, LangChain / LangGraph / LangSmith
AI strategy & governance — GenAI roadmapping, responsible & ethical AI, model explainability, audit-ready architectures
Document intelligence — AI-powered extraction platforms automating 50K+ documents annually with privacy & compliance controls built in
Full GenAI lifecycle ownership — use-case discovery, architecture, secure deployment, monitoring, continuous optimization
AI-ready data platforms — Microsoft Fabric, Azure Data Factory, Kafka, real-time pipelines feeding AI workloads
AI-agent security — MCP threat modeling, runtime defense, framework crosswalks (NIST AI RMF · NSA · OWASP LLM/Agentic)

70% faster document processing · $2.4M projected annual savings · time-to-production cut from 6 months to 8 weeks · 85% user adoption

Solution & Technical Architecture

Cloud-native systems engineered for scale, availability & compliance

Cloud modernization — on-prem → AWS / Azure migrations with high availability, security, and regulatory compliance
Distributed systems — microservices & event-driven design; high-throughput real-time rules engines for enterprise decisioning
Data engineering — ETL/ELT architectures, Azure Data Factory, Kafka streaming, cloud ↔ on-prem synchronization
Full-stack delivery — React, TypeScript, Node.js, .NET Core, Java Spring Boot, Python; multi-tenant SaaS at 50K+ MAU
DevOps & reliability — IaC, CI/CD (GitHub Actions, Azure DevOps, AWS CodePipeline), observability, fault-tolerant design
Identity & security — OAuth, Azure AD, SAML, JWT, LDAP for B2B/B2C; data governance and policy-compliant architecture

99.9% platform uptime · 30% infrastructure cost reduction · 70% less duplicate UI code via design-token component library · 35% faster feature delivery

Research & Open Source

Securing the AI-agent ecosystem — openly, measurably

The Model Context Protocol (MCP) is the de-facto standard connecting AI agents to tools and data — fast becoming critical infrastructure for enterprise and government AI. My independent research builds defenses for this layer and, uniquely, an open, vendor-neutral way to measure how well any defensive tool covers the MCP attack surface, crosswalked to NIST AI RMF, NSA MCP guidance, and the OWASP LLM & Agentic Top 10s.

Security ProxyTypeScriptApache-2.0v1.0 · MCP SDK 2.0

🛡️ mcp-bastion

Runtime reliability & security proxy for the Model Context Protocol

Sits between any MCP client (Claude Code, Cursor, Cline, Windsurf, Zed…) and its servers — self-healing connections, runtime tool-security, and a compliance-mapped audit trail. Defends against documented MCP attacks: tool poisoning, rug-pulls, cross-server exfiltration, command injection, server impersonation. v1.0 (September 2026) is rebuilt on the MCP SDK 2.0 line and speaks both protocol eras — adding the two defences only a gateway can provide once the protocol is stateless: custody of the in-band continuation state and a consent gate on in-band input requests.

62% measured coverage of a 32-vector attack surface — broadest of any tool on the public leaderboard; 77% of the vectors introduced by the July 2026 protocol revision
Held to account — 57% development vs. 44% held-out on the original 24 vectors, published as measured: structural checks generalise, phrase heuristics do not
First measured tool to detect ShareLock's published split-poisoning staging pattern and cross-server data-flow exfiltration; evasion normalisation for zero-width, homoglyph and base64
Listed in the official MCP Registry; author-verified on Glama

GitHub ↗ npm ↗

BenchmarkCC-BY-4.0 dataLive leaderboardv0.8

🧪 mcp-defense-bench

The first open, vendor-neutral benchmark of MCP defensive coverage

While existing benchmarks measure how well an agent resists attacks, mcp-defense-bench measures how much of the MCP attack surface a defensive tool actually covers — every tool driven through its real code, with matched benign controls, coverage reported per protocol revision, and — since September 2026 — three corpora: development, a pre-registered held-out set written after every defender was frozen, and a 337-item benign-only set for a false-positive rate with a confidence interval.

32 attack vectors (8 introduced by the 2026-07-28 protocol revision, verified against the specification text) crosswalked to layer, STRIDE, NIST AI RMF, NSA MCP guidance, OWASP LLM 2025 & Agentic 2026, EU AI Act obligations and ISO/IEC 42001 controls
Mapping reliability measured — published rating codebook, blind second-rater pass (κ 0.75 / 0.94), every disagreement adjudicated in the open
Benchmark-guided hardening — drove mcp-bastion from 9% → 62%, and from 44% → 77% on the new-era surface; the matched controls caught a false positive in the new defence before release
Living benchmark — the first MCP security benchmark versioned against protocol revisions, with a CI regression gate

Leaderboard ↗ GitHub ↗ Zenodo DOI ↗

WhitepaperDOI-archivedUnder peer review

📄 Measuring the Defenders

A Layer-Aware, Framework-Mapped Benchmark for MCP Security Proxies

The research paper behind the benchmark: methodology, the 24-vector threat–control crosswalk, matched-control scoring protocol, and honest results — including where every measured tool, my own included, still falls short. A revised edition incorporating expert peer-review feedback (held-out evaluation, larger benign corpus, inter-rater agreement) is under review at an international security venue.

Openly archived with citable DOIs (Figshare + Zenodo)
21 references verified against primary sources
Discloses and controls for the developer-evaluator conflict by design — vendor-neutral adapters, null baseline, reproducible runs

Figshare DOI ↗ Zenodo ↗

Supply-chain SecurityPythonZero deps

🥒 picklefort

Safe loading & scanning of AI/ML model files

Opening a model file can execute arbitrary code the instant you load it — the classic Python pickle risk, actively exploited on public model hubs. picklefort disassembles the pickle stream without executing it and fails closed: an allowlist blocks not just known-bad callables but anything unrecognized.

Scans raw pickle and PyTorch-zip formats; safe loader enforces the same policy at load time
Pure standard library — zero runtime dependencies
CLI with CI-friendly exit codes (picklefort scan --strict model.pt)

GitHub ↗ PyPI ↗

Community & ecosystem engagement

Proposed a complementary cross-citation with AgentDefense-Bench — positioning coverage completeness and detection accuracy as complementary axes of defense-side measurement
Submitted mcp-bastion for independent scoring on the agentshield-benchmark public leaderboard — inviting third-party measurement of my own tool
Listed in the official MCP Registry and author-verified on Glama; maintainer-reviewed contributions across the awesome-MCP ecosystem
Named peer reviewer on the Cloud Security Alliance Autonomous Pentest Assurance Standard (v0.9): five editor-accepted comment threads on evaluator methodology, provenance binding and adversarial testing
Design contribution to the official MCP Registry (publisher identity vs. artifact provenance) — a multi-round technical exchange with independent researchers and engineers
Independent scrutiny welcomed and credited: an external researcher's scoring-defect report was adopted as the benchmark's headline metric (changelog)
Ongoing research extends this program deeper into AI-agent security evaluation — details to follow after peer review

9% → 62%: benchmark-driven coverage improvement on 32 vectors, every step re-verified
44%: held-out coverage on the original 24 vectors, published beside the 57% development figure
7: frameworks crosswalked — STRIDE · NIST AI RMF · NSA · OWASP LLM · OWASP Agentic · EU AI Act · ISO/IEC 42001
2,500+: npm downloads (Jul–Sep 2026); 12 releases iterated in the open, latest v1.1.0

Writing

Research, explained in the open

I write up the research as it happens — the design decisions, the honest numbers, and the practical how-tos — on Medium and DEV.

Agent architectureMedium

Who Owns the Paused Agent? LangGraph vs Managed Agent Platforms on State

Where a half-finished agent run lives while it waits for a human, who can resume it, and what LangGraph runs twice when it wakes up, compared with Foundry Agent Service and AgentCore.

Gowthaman Arumugam

Architecture as a discipline of trust

Two complementary disciplines, one standard of rigor

AI & Generative AI Architecture

Solution & Technical Architecture

Securing the AI-agent ecosystem — openly, measurably

🛡️ mcp-bastion

🧪 mcp-defense-bench

📄 Measuring the Defenders

🥒 picklefort

Community & ecosystem engagement

Research, explained in the open

Who Owns the Paused Agent? LangGraph vs Managed Agent Platforms on State

Before Your Security Team Says Yes: What mcp-bastion 1.4.2 and 1.5.0 Ship for a Shadow Pilot

The Call My Audit Log Never Saw: What an End-to-End Test Found in mcp-bastion 1.4.0

Who May Call What, and Can You Prove It Later? What mcp-bastion 1.4.0 Ships

Publisher Identity Is Not Artifact Provenance: The MCP Registry Design Question

One Request, Two Users: Checking Delegate Tokens at the MCP Gateway

List-Cache Poisoning: When ttlMs Keeps a Fixed Vulnerability Alive

A2A vs MCP: The Security Boundary Sits in a Different Place

Governing AI Agents Like Fleet Assets: A Control-Tower Architecture

Five of 32 MCP Attack Vectors Are Covered by No Tool I Measured. A Proxy Is Necessary, Not Sufficient.

Tool Poisoning, Explained for People Who Do Not Do Security

Compliance by Measurement: Mapping 32 MCP Attack Vectors to the EU AI Act and ISO/IEC 42001

I Asked an LLM to Second-Rate My Security Benchmark. Here Is Where It Disagreed.

The Benign Corpus: Why Every AI Security Benchmark Needs a Denominator

MCP Went Stateless: A Security Field Guide to the 2026-07-28 Revision

Measuring the Defenders: An Honest Benchmark for AI-Agent (MCP) Security

From 9% to 63%: Letting a Benchmark Build a Better MCP Security Proxy

The MCP Reliability & Security Gap — and an Open-Source Proxy That Fills It

mcp-bastion v0.3.0: Teaching an MCP Security Proxy to Defend More of the Attack Surface

How to Put mcp-bastion in Front of Your MCP Servers — Quick Setup Guide

A track record measured in outcomes

Skills & technology matrix

Generative AI & LLMs

AI Strategy & Governance

Cloud & Infrastructure

Languages & Frameworks

Data & Platforms

Security & Identity

DevOps & Delivery

Leadership & Domain

Foundations

Post Graduate Diploma in Business Administration

Bachelor of Engineering

Let's build something provable