Levo Runtime API & AI Security Platform

Levo, Inc. is an application security company founded in 2021 by Buchi Reddy B., with its registered contact address in San Francisco, California, and backing from Foundation Capital, Essence and Firebolt Ventures. It addresses the gap between fast software releases and security by giving teams continuous visibility into the APIs and AI components their applications expose.

The Levo platform uses an eBPF sensor and agentless discovery to build a live inventory of APIs, AI agents, LLMs, MCP servers and vector stores from real traffic. On top of this inventory it runs API security testing and red-teaming, detects sensitive data such as PII, PHI and secrets in payloads, monitors drift and anomalies, and blocks malicious flows inline through runtime detection and protection modules. Named users include Five9, AngelOne, Axis Finance, Axis Securities and the Insurance Information Bureau of India.

• Runtime API inventory: Discovers APIs, agents, MCP servers and LLMs through eBPF and agentless discovery.
• API security testing: Runs automated tests based on real traffic, covering BOLA, BFLA and GraphQL.
• Sensitive data detection: Flags PII, PHI and secrets in payloads, prompts and vector queries.
• Runtime detection and protection: Alerts on threats and blocks malicious API flows inline.
• AI security: Provides AI Firewall, AI Gateway, MCP discovery and MCP security testing.
• Developer integrations: Connects with Postman, Burp Suite, GitHub, Kong, Cloudflare and Splunk.

A securities company can inventory all trading and account APIs and test them for authorization flaws before each release. A bank building open banking APIs can detect customer personal data flowing through unexpected endpoints. A fintech launching an AI chatbot can monitor its LLM and MCP connections for prompt injection and tool abuse.

Security teams get an up-to-date inventory of internal, external and shadow APIs without code changes, so untested endpoints are no longer missed. Testing based on real traffic finds authorization flaws such as BOLA and BFLA before attackers do. Sensitive data detection runs locally without sending payloads to the cloud, which helps meet privacy rules. Flexible deployment, including on-premises and air-gapped setups, suits banks and regulated firms.

APIs now carry most traffic between mobile apps, partners and cloud services, and broken authorization in APIs is a common cause of data leaks. The rapid adoption of AI agents and MCP servers adds new interfaces that traditional web firewalls do not see. Vietnamese banks, securities firms and e-commerce platforms opening APIs for open banking and partner integration need continuous API discovery and testing.

Founded in 2021 by Buchi Reddy B.; contact address 548 Market St, San Francisco, CA. Backed by Foundation Capital, Essence and Firebolt Ventures. Awards include FINSEC 2025 winner and Most Innovative Startup of the Year from the Data Security Council of India; listed as a recommended vendor in Gartner's Market Guide for API Protection.