How it works

The whole agent lifecycle, firewalled.

AIFenders sits inline between your app and the model as an OpenAI-compatible proxy. Every request passes through five guard rails — input, dialog, retrieval, execution, output — governed by one declarative JSON policy. No Colang DSL, no SDK rewrite, no per-call plumbing. Swap one base_url and the entire request lifecycle is enforced, from the first token in to the last token out.

Launch console Security & compliance

The request lifecycle

One inline hop. Five rails. Nothing reaches the model unchecked.

Your client calls /v1/chat/completions exactly as it calls OpenAI. AIFenders enforces the ingress rails, forwards a cleaned request to your chosen provider, then verifies the response on the way back out. Tool calls that cross a risk threshold divert to a human-approval queue instead of executing blind.

ClientYour app / agent

→

AIFendersGuardrail proxy

→

UpstreamLLM provider

Ingress rails — before the model

1

Input

→

2

Dialog

→

3

Retrieval

4

Execution rail — intercepts tool calls

Risk-scored. Destructive or off-domain calls divert to the human-in-the-loop approval queue instead of running.

Egress rail — after the model, streaming

5

Output

→

ClientVerified response

Need a single stage without proxying the whole call? Each rail is also exposed standalone at /v1/guard/* — ingress, dialog, retrieval, tool, and egress — so you can score a RAG chunk, vet a tool call, or verify text from anywhere in your stack.

The five rails in depth

Each rail names a threat and the technique that catches it.

All five are configured in one policy.json — thresholds, allowlists, mask types, and tool-risk rules. No DSL to learn.

1

Input

Detects direct prompt injection and jailbreaks in the user turn, and strips PII and secrets before the model sees a byte.

Weighted noisy-OR injection scoring; PII/secret masking across 15+ types with credit-card Luhn and Aadhaar Verhoeff checksum validation.

2

Dialog

Keeps the conversation inside its sanctioned scope — a support bot stays on support, a finance agent stays on finance.

Topic and SOP allowlist / blocklist enforcement over the dialogue state.

3

Retrieval

Catches the top real-world attack: a poisoned document smuggling instructions into context through your RAG pipeline.

Per-chunk indirect-injection scan on retrieved context, plus PII masking before the chunks reach the prompt.

4

Execution

Stops an agent from deleting records, moving money, or emailing data off-domain without oversight.

Risk-scored tool calls with human-in-the-loop approval for high-risk actions and RBAC / identity governance.

5

Output

Verifies the model's answer on the way out — leaked secrets, echoed PII, SQL/error dumps, system-prompt leaks.

Streaming StreamScanner that reassembles across token boundaries, catching secrets split between chunks.

Detection cascade & modes

Tune the accuracy/latency trade-off per policy.

Every rail runs a deterministic heuristic layer first. Depending on the mode, ambiguous verdicts escalate to an LLM-judge — so you pay for a second opinion only on the cases that are actually close.

fast

Deterministic only

Pure heuristics, ~sub-millisecond p95. No model call. The default hot path.

balanced

Heuristic + LLM-judge

Adds an LLM-judge on the ambiguous band only; fails open to the heuristic verdict if the judge is unavailable.

strict

Maximum enforcement

Tightest thresholds and broadest escalation for the highest-assurance workloads.

Fail-closed circuit breaker

Where the balanced judge fails open to keep benign traffic flowing, the circuit breaker fails closed: if a rail's dependencies degrade past its threshold, requests are refused rather than passed through unguarded. Safety posture is explicit, per policy — never an accident of an outage.

Multi-tenant & bring-your-own-model

Many policies, many providers, one key namespace.

An API key (aif_live_…) can hold multiple named policies, each with its own upstream provider and provider key. Select one per request with the x-aifenders-policy header — a strict finance policy and a lenient marketing policy can live side by side under the same account.

Provider-agnostic upstream

✓ Any OpenAI-compatible provider — OpenAI, OpenRouter, Groq, Together, Mistral, DeepSeek, Azure, local Ollama.
✓ Anthropic natively, plus a built-in gateway model for zero-setup starts.
✓ Bring your own key. Guardrails are provider-independent — the same policy protects any backend.

Key handling & isolation

✓ Provider keys are masked to the last 4 and never returned by the API.
✓ SSRF-hardened egress — DNS-rebinding-safe, pins the socket to a validated IP before connecting.
✓ Per-policy provider isolation, so tenants and workloads never share upstream credentials.

Deployment

A drop-in proxy, or self-hosted in your VPC.

Point any OpenAI SDK at AIFenders — one base_url and an AIFenders key. Nothing else in your code changes.

python · drop-in/v1/chat/completions

# one line changes — every call is now firewalled
from openai import OpenAI

client = OpenAI(
    base_url="https://aifenders.com/v1",
    api_key=AIFENDERS_KEY,
)
resp = client.chat.completions.create(
    model="aifenders-gateway",
    messages=[{"role":"user","content":"Summarize this contract…"}],
    # extra_headers={"x-aifenders-policy": "finance-strict"}
)

Runs anywhere

✓ Zero runtime dependencies — pure Node.js ≥18, nothing to provision.
✓ Self-host or VPC deploy keeps every request in-region for data residency.
✓ Same policy format hosted and self-hosted — no rewrite when you move.

Architecture → Quickstart →

See the rails run against your own traffic.

Create a free account, get an aif_live_… key, and swap one base_url. Every call firewalled — no code change.

Launch console Read the docs