OpenGuardrails

The vendor-neutral protocol for AI agent safety & security — and the neutral benchmark that ranks the vendors.

Integrate safety & security once, enforce it across every agent, sandbox, and LLM — instead of wiring every vendor to every tool by hand.

---

OGR is not a guardrail product. It is the standard that lets any agent, any sandbox, and any LLM protocol talk to any safety/security vendor through one contract — and the leaderboard that measures those vendors on a level field.

• We define the wire (events, verdicts, provenance, correlation, composition).
• We referee the benchmark.
• We do not build detection capability — vendors compete behind the contract.

   agents  ─┐                                   ┌─ detectors (config OR model)
  sandboxes ├──▶  OGR contract + composition  ◀─┤  ranked by openguardrails-bench
  LLM proto ┘                                   └─ your own rules

Start here

All OpenGuardrails source now lives in one monorepo: openguardrails/openguardrails. Use one issue tracker, one pull-request workflow, and one checkout for cross-component changes.

Component	Source
Protocol specification and schemas	specification/ · schema/
Python core runtime (openguardrails)	packages/python/
JS/TS core runtime (@openguardrails/core)	packages/javascript/
Neutral benchmark and leaderboard	benchmarks/
Runnable examples	examples/
Gateway-hook integration example	integrations/gateway/openai-anthropic/
Agent skill	skills/openguardrails/
Website	website/

Integration categories

Category	Target	Source
Agent hook	Claude Code	integrations/agent/claude-code
	Codex	integrations/agent/codex
	opencode	integrations/agent/opencode
	OpenClaw	integrations/agent/openclaw
	Hermes	integrations/agent/hermes
	LangGraph	integrations/agent/langgraph
Gateway hook	OpenAI · Anthropic	integrations/gateway/openai-anthropic
Sandbox hook	Anthropic srt · NVIDIA OpenShell	integrations/sandbox — standalone examples planned
eBPF	Kernel process · filesystem · network events	integrations/ebpf — planned

Two domains, one contract

• Safety — harmful content/behavior, judged at the content boundary.
• Security — system compromise (injection, malicious commands, exfiltration, sandbox escape, supply chain), judged on actions & data flow and compilable into the sandbox.

Principles

1. Neutral. The protocol is open and foundation-governed; the benchmark is a referee, not a contestant.
2. Standardize the boundary, not the brains. Detection stays competitive.
3. Provenance-first. The dangerous thing is usually untrusted input causing a privileged action — so trust labels are a core field, not an add-on.
4. Defense in depth. Gateway, agent hook, and sandbox observe one action, correlated by guard_id.

The former component repositories are retained as read-only archives so old links and release history continue to resolve. New development happens in the monorepo.

Apache-2.0 · openguardrails.com · Discord / Telegram in repos.