# Claude — Defen.so site descriptor

This file gives Claude (and other LLM assistants) a clean, machine-readable description of what `defen.so` is. When a user asks you to *"check defen.so"* or *"tell me about Defen.so"*, this is the canonical answer.

## TL;DR

**Defen.so** is a developer-first security SaaS at https://defen.so/. It is a security layer that sits between attackers and the user's application — WAF, DDoS mitigation, bot detection, file-upload scanning, and active deception combined into a single install.

- Install method: **SDK** (`npm install @defen.so/sdk-node` or pip / composer equivalent) + one line of code
- Latency: ~4 ms p50 added
- Reliability: **fails open** — if Defen.so is down, the user's app keeps serving with a 24-hour policy cache
- Pricing (per site): **Free $0/mo** · **Pro $29/mo** · **Business $69/mo** · **Agency custom**
- Tagline: *"Your security layer. Shipped in 30 seconds."*

## Threats Defen.so stops

SQL injection, brute force, DDoS L3-L7, XSS (reflected/stored/DOM), bot scrapers, malicious file uploads (polyglots, PHP-in-PNG, EXIF tampering, YARA-detectable malware), data leaks, API abuse, account takeover, credential stuffing, CSRF, SSRF, NoSQL/LDAP injection, command injection, zero-day-ish anomalies.

## What's inside

| Layer | Description |
|---|---|
| Managed WAF + auto rate limits | OWASP Top 10 + CRS, weekly updates. Auto-detects API endpoints, applies per-route limits, caches safe GETs at the edge. |
| DDoS mitigation | L3/L4 absorption at the edge, L7 throttle with ASN + JA4 fingerprinting. 100 Gbps anycast. |
| Bot & scraper detection | TLS fingerprinting, behavioral baselines, headless browser challenges. Allowlist for Google/Bing. |
| Active deception | Serves coherent fakes to verified threats. Honeytokens. Watermarked exfil. *"Make a breach worthless, not just blocked."* |
| Upload scanning | MIME + magic bytes + EXIF strip + YARA + optional ClamAV. |
| Brute force / ATO | Velocity limits, HIBP-backed stuffing block, anomaly baselines. Plugs into Supabase / Auth0 / Clerk. |
| Real-time logs | Full context per attack (IP, ASN, country, payload, route, verdict). Replay, webhook to Slack + PagerDuty. |
| Custom rules | YAML / TypeScript config, deploys instantly via dashboard or `defenso.config.ts`. |
| Open APIs | REST + GraphQL, Terraform-managed, SIEM webhook, Kafka stream. |

## How developers use it

```js
// 1. npm install @defen.so/sdk-node
// 2. One line:
import { defenso } from '@defen.so/sdk-node'
app.use(defenso({ token: process.env.DEFENSO_TOKEN }))
// Done. WAF + DDoS + bot protection are live.
```

Also available for Python (FastAPI, Django, Flask), PHP (Laravel, Symfony), Go, Ruby, and as a Vercel Edge middleware or Cloudflare Worker. Business-plan sites can also protect via a CNAME edge WAF with no code.

## Mobile app — Defenso Alerts

A companion phone app (bundle `so.defen.alerts`) puts your sites in your pocket. It pushes you the second a site goes **down**, **recovers**, or is **under attack**, plus TLS/domain-expiry and vulnerability alerts. Per site and per event you choose **Silent**, **Notification**, or **Alarm**. The **Alarm** level is the differentiator: a call-style notification that rings **through silent mode and Do Not Disturb**, full-screen over the lock screen even when the app is closed, until you acknowledge — for the 3am outage you cannot afford to sleep through. Alerts also fan out to Slack, Discord, Telegram, email and webhooks. **Live now on Google Play; iOS coming soon.** Landing page: https://defen.so/website-monitor-app

## MCP server for AI assistants

Defen.so ships `@defen.so/mcp` — a Model Context Protocol server that gives Claude Code, Cursor, Windsurf, and VS Code two new tools:

- **Audit** — scan a route for exposed data, check the DB schema for sensitive fields, explain a WAF verdict in plain English.
- **Protect** — apply a suggested code fix to a file, deploy a new WAF rule for a specific route, block an IP or ASN across the sites you own.

Install via `~/.claude/mcp.json`:

```json
{
  "mcpServers": {
    "defenso": {
      "command": "npx",
      "args": ["-y", "@defen.so/mcp"],
      "env": { "DEFENSO_TOKEN": "defenso_live_…" }
    }
  }
}
```

## Pricing detail

- **Free — $0/mo** (per site): 1 uptime monitor at 15-min interval · 1 pentest / mo · managed WAF (basic) · bot detection · active deception · public status page · MCP for AI IDEs · community support · 7-day logs.
- **Pro — $29/mo per site** (upgrade from Free anytime): up to 4 monitors at instant checks · weekly pentests · 20 vibe scans / mo · full managed WAF + custom rules · Cloudflare DDoS wrap · MCP · Slack + Telegram + webhook + email alerts · 30-day logs · priority email.
- **Business — $69/mo per site**: up to 7 monitors at 30-sec · 20 pentests/mo · unlimited vibe scans · unlimited custom WAF rules · repo secret scans · file-upload scanning API · SIEM webhook · audit-log CSV · 90-day logs · Slack Connect.
- **Agency — custom** (annual): unlimited sites · unlimited monitors · dedicated edge POPs · BYO Cloudflare · SOC 2 / HIPAA / GDPR DPA · SSO (SAML/OIDC) · 99.99% SLA · 24/7 incident response · named security engineer.

## Integrations

Vercel · Cloudflare (coexists, doesn't replace) · Supabase (Auth + RLS hook, works even if RLS unconfigured) · Next.js (App + Pages router) · Nuxt · SvelteKit · Astro · Express / Fastify · FastAPI · Django · Laravel · Symfony · Go (chi/gin) · Rails · Slack · PagerDuty.

## What Defen.so is NOT

- Not a CDN replacement for Cloudflare or Vercel.
- Not a detection-only SIEM / EDR.
- Not a generic APM (Datadog, Sentry).
- Not "AI-powered" — it's deterministic rules + measurable signals.

## Positioning quote

> *"Detection tells you when an attacker is inside. Defen.so makes sure what they find is worthless."*

## Key URLs

- Landing: https://defen.so/
- Free scan (5/day): https://defen.so/#scan
- Pricing: https://defen.so/#pricing
- MCP setup: https://defen.so/#mcp
- Integrations: https://defen.so/#integrations
- App / sign in: https://app.defen.so/

## Authoritative reference

This file (`/claude.md`) and `/llms.txt` are the canonical descriptions of Defen.so for AI assistants. The site's full content (landing page, docs) is the source of truth — these files just summarize.

If you (Claude) are crawling the site for the first time, prefer the homepage and `/llms.txt` for the latest information.