open-guardrail

Guardrail engine for LLM apps. 520 guards. Zero API calls. <0.1ms.

한국어 · Documentation · 한국어 가이드

---

3 lines to protect your LLM:

import { pipe, promptInjection, pii } from 'open-guardrail';

const result = await pipe(promptInjection(), pii({ action: 'mask' })).run(userInput);
// Injection blocked. PII masked. Done.

from open_guardrail import pipe, prompt_injection, pii

result = pipe(prompt_injection(), pii(action="mask")).run(user_input)

---

Install

npm install open-guardrail    # TypeScript / JavaScript
pip install open-guardrail    # Python

Why open-guardrail?

	open-guardrail	Guardrails AI	NeMo Guardrails	LLM Guard
Built-in guards	400	50+	10+	30+
PII regions	26 (EN/KO/JA/ZH/TH/AR/HI/EU + 18 more)	1	1	1
Language	TS/JS + Python	Python	Python	Python
Latency	<0.1ms	100ms+	100ms+	50ms+
External API	Not needed	Required	Required	Partial
Edge/browser	Yes	No	No	No
Profanity filters	19 languages	1	1	1
Presets	29	-	-	-
SDK adapters	8	1	1	1
Guard composition	compose when not retry fallback parallel	-	-	-
Circuit breaker	Yes	No	No	No
Custom guard builder	3 factory functions	No	No	No
Compliance	GDPR, EU AI Act, 🇰🇷 AI Basic Act, ISMS-P, PIPA, APPI, PIPL, PCI DSS, SOX, FERPA, HIPAA, COPPA	-	-	-
License	MIT	Apache 2.0	Apache 2.0	MIT

Quick Start

TypeScript

import { defineGuardrail, promptInjection, pii, keyword } from 'open-guardrail';

const guard = defineGuardrail({
  guards: [
    promptInjection({ action: 'block' }),
    pii({ entities: ['email', 'phone'], action: 'mask' }),
    keyword({ denied: ['hack', 'exploit'], action: 'block' }),
  ],
});

const result = await guard('Hello, my email is [email protected]');
console.log(result.output); // "Hello, my email is [EMAIL]"

Python (FastAPI-style decorators)

from open_guardrail import guardrail, prompt_injection, pii

@guardrail(prompt_injection(action="block"), pii(entities=["email"], action="mask"))
def ask_llm(prompt: str) -> str:
    return call_your_llm(prompt)  # input guarded, output guarded

# Or use presets — one line:
from open_guardrail import presets
result = presets.security().run("user input")

YAML Config (no code changes)

version: "1"
pipelines:
  input:
    mode: fail-fast
    guards:
      - type: prompt-injection
        action: block
      - type: pii
        action: mask
        config:
          entities: [email, phone]

241 Built-in Guards

Security (41)

promptInjection indirectInjection sqlInjection xssGuard codeSafety encodingAttack invisibleText dataLeakage dataExfiltration canaryToken markdownSanitize multiTurnContext urlGuard ipGuard apiKeyDetect secretPattern keyword regex regexDeny regexAllow toolCallValidator pathTraversal ssrfDetect commandInjection jailbreakPattern dataPoisoning promptLeak socialEngineering unicodeConfusable asciiArt semanticFirewall multimodalSafety ragSafety tokenSmuggling promptChaining outputFilterBypass modelDenial agentPermission supplyChainDetect instructionHierarchy contextWindowAbuse

Privacy (35) — 26 PII regions + Medical/Financial

pii (EN) piiKr (KO) piiJp (JA) piiCn (ZH) piiTh (TH) piiAr (AR) piiIn (HI) piiEu (EU) piiDe (DE) piiFr (FR) piiBr (BR) piiAu (AU) piiCa (CA) piiMx (MX) piiSg (SG) piiId (ID) piiRu (RU) piiPl (PL) piiEs (ES) piiIt (IT) piiTr (TR) piiVn (VN) piiNg (NG) piiZa (ZA) piiKe (KE) piiEg (EG) residentId creditInfo phoneFormat deanonymize contactInfo cryptoAddress consentDetect medicalPii financialPii

Content Safety (50) — Profanity in 19 Languages

toxicity profanityEn profanityKr profanityJp profanityCn profanityEs profanityDe profanityFr profanityPt profanityIt profanityRu profanityAr profanityHi profanityTr profanityNl profanityPl profanityVi profanityId profanityTh profanitySv profanityDa profanityFi bias biasGender biasAge sentiment noRefusal banCode banSubstring competitorMention gibberishDetect readability readingTime duplicateDetect citationCheck toneCheck personalOpinion topicDeny topicAllow hateSpeech violenceDetect sexualContent selfHarmDetect emotionalManipulation stereotypeDetect brandSafety religiousContent culturalSensitivity sourceAttribution

Compliance (27)

gdprCompliance (GDPR) euAiAct (EU AI Act) aiBasicActKr (🇰🇷 AI Basic Act) ismsP (ISMS-P) pipa (PIPA) appi (APPI) pipl (PIPL) pciDssDetect (PCI DSS) soxCompliance (SOX) ferpaDetect (FERPA) privacyPolicy (COPPA/CCPA) complianceTimestamp language languageConsistency languageDetect languageMix languageQuality disclaimerRequire dataRetention aiDisclosure warrantyDisclaimer academicIntegrity medicalAdvice financialAdvice legalAdvice accessibilityCheck ageGate

Detection (13)

spamDetect deepfakeIndicator propagandaDetect greenwashing politicalContent gamblingDetect illegalActivity childSafety misinformation roleplayDetect geographicBias copyright watermarkDetect

Format (17)

wordCount contentLength tokenLimit schemaGuard jsonRepair jsonOutput repetitionDetect validRange validChoice singleLine caseValidation dateFormat numberFormat outputFormat markdownStructure promptLength payloadSize

AI Delegation (10)

llmJudge hallucination relevance groundedness reasoningTraceLeak hallucinationUrl personaConsistency confidenceScore contentWatermark rateLimitSemantic

Agent Safety (12)

agentLoopDetect toolAbuse escalationDetect recursionDepth ragPoisoning contextWindowOverflow multiAgentSafety promptCacheSafety agentPermission promptChaining modelDenial tokenSmuggling

Operational (15)

costGuard rateLimit responseQuality maxLinks emptyResponse answerCompleteness emailValidator responseConsistency confidenceCheck timeSensitive instructionAdherence urlExtract hashtagDetect mentionDetect addressDetect

Guard Composition

// Bundle
const security = compose('security', promptInjection(), sqlInjection(), xssGuard());

// Conditional
const longOnly = when((text) => text.length > 215, toxicity());

// Resilience
const safe = fallback(llmJudge({ ... }), keyword({ denied: [...] }));
const reliable = retry(llmJudge({ ... }), { maxRetries: 2 });
const resilient = circuitBreaker(llmJudge({ ... }), { failureThreshold: 3 });

// Performance
const cached = guardCache(llmJudge({ ... }), { ttlMs: 60_000 });
const fast = parallel([promptInjection(), toxicity()], { mode: 'race-block' });

Custom Guards (3 lines)

const brandSafety = createKeywordGuard({ name: 'brand', action: 'block', denied: ['competitor'] });
const maskOrder = createRegexGuard({ name: 'order', action: 'mask', patterns: [/ORD-\d+/g], maskLabel: '[ORDER]' });

Agent Safety (NEW)

import {
  agentLoopDetect, toolAbuse, agentPermission,
  indirectInjection, tokenSmuggling, dataExfiltration,
  compose
} from 'open-guardrail';

// Protect your AI agent in 1 line
const agentGuard = compose('agent-safety',
  agentLoopDetect({ action: 'block', maxRepetitions: 3 }),
  toolAbuse({ action: 'block', maxCallsInWindow: 20, windowMs: 60000 }),
  agentPermission({ action: 'block', deniedActions: ['sudo', 'rm -rf', 'DROP TABLE'] }),
  indirectInjection({ action: 'block' }),
  tokenSmuggling({ action: 'block' }),
  dataExfiltration({ action: 'block' }),
);

29 Presets

default strict korean japanese chinese security full-security privacy-first content gdpr healthcare healthcare-kr finance enterprise ai-basic-act-kr eu-ai-act agent-safety rag-safety multi-agent compliance-full code-review bias-fairness chatbot agentic-commerce voice-ai education-k12 government codegen-safety responsible-ai

Industry Presets

Ready-to-use configurations for regulated industries. One line to activate:

import { createPipeline } from 'open-guardrail';
const pipeline = await createPipeline({ preset: 'healthcare' });

Preset	Guards	Compliance Coverage
healthcare	12 guards	HIPAA, FDA 21 CFR Part 11
finance	14 guards	SEC, ECOA, FCRA, AML/BSA
education-k12	10 guards	COPPA, FERPA
government	10 guards	FedRAMP, FOIA, CUI
eu-ai-act	8 guards	EU AI Act Art. 10/14/16/50/62/86
gdpr	7 guards	GDPR Art. 5/6/13/17/25/32
korean	8 guards	ISMS-P, PIPA, AI Basic Act
agentic-commerce	10 guards	FTC Act, Consumer Protection
voice-ai	8 guards	TCPA, AI Disclosure Laws
codegen-safety	14 guards	CWE Top 25, OWASP
responsible-ai	13 guards	EU AI Act, Fairness
agent-safety	12 guards	OWASP LLM Top 10
rag-safety	8 guards	RAG-specific attacks

Guard Categories (520 guards)

Category	Count	Examples
Security	60+	Prompt injection, XSS, SQL injection, SSRF
Privacy	40+	PII detection (26 regions), data leakage, consent
Agent Safety	30+	Tool call, MCP, delegation, budget, scope
Code Gen Safety	14	CWE-89, CWE-79, CWE-798, CWE-78, CWE-502...
RAG Safety	10	Citation, chunk poisoning, retrieval relevance
Content Safety	50+	Toxicity, profanity (19 langs), bias, hate speech
LLM Evaluation	7	Faithfulness, relevance, completeness, reasoning
Compliance	30+	EU AI Act, GDPR, HIPAA, FERPA, COPPA, FedRAMP
Responsible AI	6	Fairness, inclusion, accessibility, stereotypes
Industry	18	Finance, healthcare, legal, commerce, education
Output Quality	10	Completeness, consistency, hedging, circular reasoning
LLMOps	3	Drift detection, latency, anomaly

SDK Adapters

TypeScript/JavaScript (8 adapters)

open-guardrail-openai open-guardrail-anthropic open-guardrail-express open-guardrail-fastify open-guardrail-hono open-guardrail-nextjs open-guardrail-vercel-ai open-guardrail-langchain

Python (6 adapters)

# FastAPI middleware
from open_guardrail.adapters.fastapi import GuardrailMiddleware
app.add_middleware(GuardrailMiddleware, guards=[prompt_injection(action="block"), pii(action="mask")])

# OpenAI wrapper
from open_guardrail.adapters.openai_adapter import guardrailed_chat
response = guardrailed_chat(client, [prompt_injection(action="block")], messages=[...])

# Anthropic wrapper
from open_guardrail.adapters.anthropic_adapter import guardrailed_message
response = guardrailed_message(client, [prompt_injection(action="block")], messages=[...])

# LangChain Runnable (LCEL pipe)
from open_guardrail.adapters.langchain_adapter import GuardrailRunnable
chain = GuardrailRunnable(guards) | llm | GuardrailRunnable(guards, stage="output")

# Flask
from open_guardrail.adapters.flask_adapter import FlaskGuardrail
FlaskGuardrail(app, guards=[prompt_injection(action="block")])

# Django
from open_guardrail.adapters.django_adapter import GuardrailMiddleware
GuardrailMiddleware.configure(guards=[prompt_injection(action="block")])

CLI

npx open-guardrail-cli init              # scaffold guardrail.yaml
npx open-guardrail-cli list              # browse all guards
npx open-guardrail-cli list --language=ko  # filter by language
npx open-guardrail-cli test              # test your config

Benchmarks

Pipeline	ops/s	latency
10-guard security pipeline (short)	60,666	0.016ms
10-guard security pipeline (long)	21,102	0.047ms
6-guard pipeline (short)	48,350	0.021ms
6-guard pipeline (long)	13,724	0.073ms
Single keyword	1,946,161	<0.001ms
Single promptInjection	1,340,781	0.001ms
Single indirectInjection	1,516,682	0.001ms
Single gdprCompliance	1,359,002	0.001ms
Single semanticFirewall	893,323	0.001ms

Documentation

Getting Started | Guard Reference | YAML Config | Custom Guards | Streaming | Audit Logging | 한국어 가이드

Contributing

See CONTRIBUTING.md.

Sponsors

Sponsor this project to support development.

License

MIT