AI Defense Stack

LLM firewalls & guardrails

CalypsoAI (F5 AI Guardrails): runtime guardrail for AI models and agents

CalypsoAI is a runtime guardrail for AI models and agents from F5. It is a commercial product offered as: Self-hosted, On-prem. Pricing model: not published. The vendor's page now calls it F5 AI Guardrails.

  • Last reviewed
Visit CalypsoAI (opens in a new tab) Documentation (opens in a new tab)
Commercial Now F5 AI Guardrails Layer 6: Runtime guardrails

Best for

Enterprises that need guardrails inside private cloud, on-premises or air-gapped environments and already work with F5

Ownership

F5 announced on September 29, 2025 that it had completed its acquisition of CalypsoAI. Source, checked October 21, 2026: f5.com (opens in a new tab)

Consider instead if

  • You want a hosted API you can call without running the guardrails yourself. See Lakera Guard.
  • You want an open-source library you can modify and run entirely yourself. See NeMo Guardrails.

What CalypsoAI does

CalypsoAI was an enterprise AI security vendor that F5 acquired, announcing completion of the deal in September 2025. F5 now describes the acquired runtime enforcement as F5 AI Guardrails, a commercial product that protects deployed models and agents against prompt injection, data exfiltration and jailbreaks. The product page lists custom guardrails written through a natural-language interface, PII leakage controls, and guardrails on agent actions and tool use. It is described as model-agnostic and deployable in public cloud, private cloud, on-premises or air-gapped environments. F5 names a separate F5 AI Red Team product for adversarial testing. The page states no prices, so confirm pricing and current naming with F5.

This summary is our own wording of the sourced facts on this page.

Key facts

Each value links to the page that states it, with the date we checked it.

Vendor
F5 (CalypsoAI) Source, checked October 21, 2026: f5.com (opens in a new tab)
Status
Renamed Source, checked October 21, 2026: f5.com (opens in a new tab)
Current name
F5 AI Guardrails Source, checked October 21, 2026: f5.com (opens in a new tab)
Ownership
F5 announced on September 29, 2025 that it had completed its acquisition of CalypsoAI. Source, checked October 21, 2026: f5.com (opens in a new tab)
Open source
No: closed source (proprietary) Source, checked October 21, 2026: f5.com (opens in a new tab)
Latest release
Not documented in the sources we checked
Deployment
Self-hosted, On-prem Source, checked October 21, 2026: f5.com (opens in a new tab)
Pricing model
Not published in the sources we checked Source, checked October 21, 2026: f5.com (opens in a new tab)
Website
f5.com Source, checked October 21, 2026: f5.com (opens in a new tab)
Documentation
docs.aisecurity.f5.com Source, checked October 21, 2026: docs.aisecurity.f5.com (opens in a new tab)
API reference
Not documented in the sources we checked
Quickstart
Not documented in the sources we checked
Security page
Not documented in the sources we checked
Attestations or disclosure
Not documented in the sources we checked

Capabilities

As documented by the vendor or project. The tag is our label from a controlled vocabulary.

Where CalypsoAI fits in our AI security layers

Our analysis

Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document. How the model works.

AI security layers that CalypsoAI covers, with the role, how each applies and what it rests on
LayerRoleHow it appliesBased on
L6 Runtime Runtime guardrails Primary Screen what goes into and comes out of a model in live traffic, and limit abuse of the model endpoint. Follows its category, LLM firewalls & guardrails
L7 Agent access Agent and tool access Also covers Documents blocking of unauthorized tool calls by agents. Enforces guardrails on agent actions and tool use and can block unauthorized tool calls
L5 Data Data protection Also covers Documents controls for personal data leakage and semantic data security. Controls PII leakage and applies semantic data security for standard and custom categories

OWASP LLM Top 10 mapping

Our analysis

The risk list is OWASP's (Top 10 for LLM Applications, 2025). The mapping is our analysis, and each row rests on a capability the sources document.

OWASP LLM risks mapped to CalypsoAI, with the capabilities each mapping rests on
RiskHow it appliesBased on
LLM01 Prompt Injection Protects against prompt injection and jailbreak attacks at runtime. Protects against prompt injection attacks; Protects against jailbreak attacks using a continuously updated attack library
LLM02 Sensitive Information Disclosure PII leakage controls and semantic data security limit sensitive data exposure. Controls PII leakage and applies semantic data security for standard and custom categories
LLM06 Excessive Agency Guardrails on agent actions and tool use limit excessive agency. Enforces guardrails on agent actions and tool use and can block unauthorized tool calls

Not mapped in our analysis: LLM05, LLM07, LLM09, LLM10. These are risks we expect tools in this category to cover; the sources we checked do not document a matching capability.

Alternatives and related tools

More in LLM firewalls & guardrails, ranked within the category by Coverage Score.

NVIDIA NeMo Guardrails

NVIDIA

Open sourceApache-2.0
  • Library
  • Self-hosted
  • API

Adds programmable input, dialog, retrieval, execution and output rails to LLM applications.

Best for: Teams that want to script rules for one LLM application in Python and run them in their own infrastructure

Coverage Score 76 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM05 Improper Output Handling
  • LLM06 Excessive Agency

Reviewed

Portkey AI Gateway

Palo Alto Networks (Portkey)

Open sourceMIT Freemium Now Prisma AIRS AI Gateway
  • SaaS
  • Self-hosted
  • API

Routes LLM traffic through one gateway API and runs input and output guardrail checks on each request.

Best for: Teams that want a single gateway for several LLM providers with guardrail checks, available as open source or as a hosted service

Coverage Score 69 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM05 Improper Output Handling
  • LLM09 Misinformation

Reviewed

Kong AI Gateway

Kong

Open sourceApache-2.0
  • Self-hosted
  • SaaS
  • API

Routes LLM traffic through Kong with prompt guards, PII sanitization, spend limits and observability.

Best for: Teams that already run Kong as an API gateway and want LLM routing and prompt controls on the same data plane

Coverage Score 65 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM10 Unbounded Consumption

Reviewed

CalypsoAI FAQ

Is CalypsoAI open source?

No. It is a commercial product, now sold by F5 as F5 AI Guardrails, and we found no public source repository.

What happened to CalypsoAI?

F5 announced on September 29, 2025 that it had completed its acquisition of CalypsoAI. F5 now delivers the acquired capabilities as F5 AI Guardrails and F5 AI Red Team, and calypsoai.com redirects to the F5 product page.

Where can F5 AI Guardrails run?

The product page lists public cloud, private cloud, and on-premises or fully air-gapped environments.

Key facts you can cite

We have no commercial relationship with F5 (CalypsoAI).

Sources & last reviewed

Last reviewed . We compile from the vendors' own public pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.