Secure your apps, APIs, and infra in the era of superintelligence.
Explore the platform Why we built LayerV Watch the 3-minute filmNo open port
Your app can reach the internet. The internet can’t reach your app.
How it worksNothing answers
No banner, no reply, no login page for an attacker to work on.
See what’s exposedNothing to replace
Your cloud, your identity provider, your app’s own login.
See what you deploy
Going live
Building is lightning fast. Publishing securely is harder than ever.
Your team can build and ship with AI in their sleep. We make securing your software that easy.
| The usual wayGuard a door. | With LayerVRemove the door. | |
|---|---|---|
| To go live | Public DNS, a load balancer, a firewall ticket and a login page. Then again for the next app. | One container beside the app, connecting out. No inbound rule to open. |
| Scanner sees | Open port · TLS certificate · login page · software version | No reply |
| Who can try | Anyone on the internet, with automated tools that never sleep | Only people and agents holding access you issued |
| You defend | The app, its login, its server, and the public entrance in front of it | Your app and network, from the people you let in. Still your job, with a fraction of the surface. |
Less to build, less to approve, less to defend. You still patch, with far less exposed while you do.
Mythos-ready security
Attacks now run at machine speed. Give them nothing to find.
Mythos is a trademark of Anthropic, PBC. LayerV is not affiliated with or endorsed by Anthropic.
How it works
Protect and connect.
Three steps to make your resources invisible and share them securely.
01
Deploy the connector
It runs beside the app, reaches it on your private network, and connects out to LayerV.
02
Your code issues a link
After your sign-in or approval, your backend creates a link for one app, with limits you set.
03
Open the link
LayerV checks the link before any connection opens, and the connector carries the traffic.
Why we built LayerV.
A three-minute film with co-founder Justin Posey on the idea behind LayerV.
Justin Posey, co-founder and CEO. Watch on YouTube
Private by design
Access without putting your apps on the public internet.
Your applications stay on your private network. A connector beside them knocks, then connects out to LayerV, so there’s no inbound door to open. Access begins only when your backend grants it.
LayerV’s access services are public, like any website. The gateway your traffic passes through answers only a valid knock, and your app has no public route at all.
Under the hood
“Isn’t this just a reverse tunnel?”
The outbound connection is the plumbing. The protection is what happens first. A plain tunnel gives your app a public URL that answers anyone who finds it. With LayerV, no public address answers for your app. A path exists only after a verified knock and a grant your backend issued, and the connector carries approved traffic to the one app it was set up for.
It knocks before it connects
The connector sends an encrypted, authenticated knock to LayerV over UDP 443. Only after LayerV verifies it does the connector’s tunnel open. No knock, no connection.
Nothing answers a stranger
LayerV’s gateway doesn’t respond to anything that isn’t a valid knock. No reply, no banner, no error, so a scanner can’t tell anything is there.
Access opens one session at a time
A checked grant opens a path to one app, for one source address. When the session ends or you revoke it, the path closes again.
Why a UDP knock is harder to find
A web server on TCP has to answer to work, so scanners find it quickly. A UDP knock port can stay silent to everything without a valid key. The connector only needs outbound UDP 443 and a TCP path, listed in the network requirements.
Solutions
What do you need to protect most?
Make anything invisible with LayerV. Explore the solutions, or tell us about yours.
- Hide internal applications
- Take admin consoles and internal tools off the public internet.
- Contractor and vendor access
- Time-limited access to one resource, revoked when the work ends.
- Protect APIs
- Keep an API private. People and agents reach it through issued access.
- Remote access without a VPN
- Reach internal apps from anywhere without a network-wide grant.
Works with your stack
- CLIInstall with Homebrew
- SDKsGo, Python, and TypeScript
- REST APIOpenAPI reference
- AgentsMCP server and agent skill
Go deeper
Explore LayerV
Built on OpenNHP, the Cloud Security Alliance’s Network Hiding Protocol, LayerV makes your software invisible to attackers and reachable only by the people and agents you choose. Try it today.
- How it worksHide, access, control: the platform in three parts, and what stays yours.
- Enterprise connectorWhat the connector needs to run in production, and how to deploy it.
- API referenceEvery endpoint, from issuing access to revoking it.
- OpenNHPThe Cloud Security Alliance protocol work LayerV builds on.
- Responsible disclosureHow to report a vulnerability to us.
Keep your applications private.
Grant access as needed.
Access issuedTime-limited
Your applicationPrivate network