AI Defense Stack

LLM firewalls & guardrails

Guardrails AI: open-source Python guardrails framework

Guardrails AI is an open-source Python guardrails framework from Guardrails AI. It is released under the Apache-2.0 license and is offered as: Library, Self-hosted, API.

  • Last reviewed
Visit Guardrails AI (opens in a new tab) Documentation (opens in a new tab) Source code (opens in a new tab)
Open sourceApache-2.0 Layer 6: Runtime guardrails

Best for

Python teams that want to compose validators around LLM calls and also enforce structured output formats

Ownership

Harvey announced its acquisition of Guardrails AI on September 9, 2026. Source, checked October 21, 2026: harvey.ai (opens in a new tab)

Consider instead if

  • You prefer a hosted API over assembling and running validators yourself. See Lakera Guard.
  • You want dialog flow rules and rails for retrieval and tool calls in one toolkit. See NeMo Guardrails.

What Guardrails AI does

Guardrails AI is an open-source Python framework for adding guards to the inputs and outputs of LLM applications. You combine validators, which are pre-built checks for specific risks such as toxic language, competitor mentions or regex matches, into guards that run around a model call. The framework can also generate structured data that matches a Pydantic model. The Guardrails Hub is a collection of validators that the README says are moving to pip packages, after it announced a planned cutoff of August 25, 2026 for hosted remote inferencing, and the Guardrails Server runs your guards as a REST service that you host. It is free under the Apache-2.0 license. Harvey announced its acquisition of Guardrails AI in September 2026, so check the repository for how maintenance continues. It is a library you assemble yourself, not a managed filtering service.

This summary is our own wording of the sourced facts on this page.

Key facts

Each value links to the page that states it, with the date we checked it.

Vendor
Guardrails AI Source, checked October 21, 2026: guardrailsai.com (opens in a new tab)
Status
Active Source, checked October 21, 2026: api.github.com (opens in a new tab)
Ownership
Harvey announced its acquisition of Guardrails AI on September 9, 2026. Source, checked October 21, 2026: harvey.ai (opens in a new tab)
Open source
Yes: Apache-2.0 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Repository
github.com Source, checked October 21, 2026: api.github.com (opens in a new tab)
GitHub stars
7,552 as of October 21, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Latest push
October 21, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Latest release
August 14, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Deployment
Library, Self-hosted, API Source, checked October 21, 2026: github.com (opens in a new tab)
Pricing model
Free Source, checked October 21, 2026: github.com (opens in a new tab)
Website
guardrailsai.com Source, checked October 21, 2026: guardrailsai.com (opens in a new tab)
Documentation
guardrailsai.com Source, checked October 21, 2026: guardrailsai.com (opens in a new tab)
API reference
Not documented in the sources we checked
Quickstart
Not documented in the sources we checked
Security page
Not documented in the sources we checked
Attestations or disclosure
Not documented in the sources we checked

Capabilities

As documented by the vendor or project. The tag is our label from a controlled vocabulary.

Where Guardrails AI fits in our AI security layers

Our analysis

Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document. How the model works.

AI security layers that Guardrails AI covers, with the role, how each applies and what it rests on
LayerRoleHow it appliesBased on
L6 Runtime Runtime guardrails Primary Screen what goes into and comes out of a model in live traffic, and limit abuse of the model endpoint. Follows its category, LLM firewalls & guardrails

OWASP LLM Top 10 mapping

Our analysis

The risk list is OWASP's (Top 10 for LLM Applications, 2025). The mapping is our analysis, and each row rests on a capability the sources document.

OWASP LLM risks mapped to Guardrails AI, with the capabilities each mapping rests on
RiskHow it appliesBased on
LLM05 Improper Output Handling Output guards check model responses against validators before the application uses them. Runs input and output guards that detect and mitigate specific risks
LLM09 Misinformation The homepage lists hallucination detection among its production guardrails. Detects hallucinations in model output as part of its production guardrails

Not mapped in our analysis: LLM01, LLM02, LLM07, LLM10. These are risks we expect tools in this category to cover; the sources we checked do not document a matching capability.

Alternatives and related tools

More in LLM firewalls & guardrails, ranked within the category by Coverage Score.

NVIDIA NeMo Guardrails

NVIDIA

Open sourceApache-2.0
  • Library
  • Self-hosted
  • API

Adds programmable input, dialog, retrieval, execution and output rails to LLM applications.

Best for: Teams that want to script rules for one LLM application in Python and run them in their own infrastructure

Coverage Score 76 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM05 Improper Output Handling
  • LLM06 Excessive Agency

Reviewed

Portkey AI Gateway

Palo Alto Networks (Portkey)

Open sourceMIT Freemium Now Prisma AIRS AI Gateway
  • SaaS
  • Self-hosted
  • API

Routes LLM traffic through one gateway API and runs input and output guardrail checks on each request.

Best for: Teams that want a single gateway for several LLM providers with guardrail checks, available as open source or as a hosted service

Coverage Score 69 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM05 Improper Output Handling
  • LLM09 Misinformation

Reviewed

Kong AI Gateway

Kong

Open sourceApache-2.0
  • Self-hosted
  • SaaS
  • API

Routes LLM traffic through Kong with prompt guards, PII sanitization, spend limits and observability.

Best for: Teams that already run Kong as an API gateway and want LLM routing and prompt controls on the same data plane

Coverage Score 65 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM10 Unbounded Consumption

Reviewed

Head-to-head comparisons

Guardrails AI FAQ

Is Guardrails AI open source?

Yes. The Python framework is released under the Apache-2.0 license, and the code is on GitHub at guardrails-ai/guardrails.

Who owns Guardrails AI?

Harvey announced its acquisition of Guardrails AI on September 9, 2026. Check the repository for how the open-source project is maintained going forward.

Can Guardrails AI run as a server?

Yes. The README describes a Guardrails Server that exposes your guards through a REST API, with Docker recommended for production, besides use as a Python library.

Key facts you can cite

We have no commercial relationship with Guardrails AI.

Sources & last reviewed

Last reviewed . We compile from the vendors' own public pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.