AI Defense Stack

LLM firewalls & guardrails

LLM Guard: open-source input and output scanner toolkit

LLM Guard is an open-source input and output scanner toolkit from Palo Alto Networks (Protect AI). It is released under the MIT license and is offered as: Library, Self-hosted, API.

  • Last reviewed
Visit LLM Guard (opens in a new tab) Documentation (opens in a new tab) Source code (opens in a new tab)
Open sourceMIT Archived Layer 6: Runtime guardrails

Best for

Teams that already run LLM Guard and want to read the scanner set, or that want a MIT-licensed codebase to fork and maintain themselves

Ownership

Palo Alto Networks announced on July 22, 2025 that it completed its acquisition of Protect AI. Source, checked October 21, 2026: paloaltonetworks.com (opens in a new tab)

Consider instead if

  • You want an open-source guardrails library that is still in active development. See NeMo Guardrails.
  • You prefer a hosted API over running scanners yourself. See Lakera Guard.

What LLM Guard does

LLM Guard is an open-source Python toolkit from Protect AI that screens LLM prompts and responses with modular scanners. The documentation lists input scanners such as prompt injection, anonymization, secrets, toxicity, banned topics and token limits, and output scanners such as malicious URLs, bias, relevance and JSON checks. You can run it as a library or deploy it as an API. It is MIT licensed and free to use. The GitHub repository was archived in July 2026 and its README says the project is no longer under active development or maintained, so weigh that before you adopt it. Palo Alto Networks announced in July 2025 that it had completed its acquisition of Protect AI.

This summary is our own wording of the sourced facts on this page.

Key facts

Each value links to the page that states it, with the date we checked it.

Vendor
Palo Alto Networks (Protect AI) Source, checked October 21, 2026: paloaltonetworks.com (opens in a new tab)
Status
Archived Source, checked October 21, 2026: github.com (opens in a new tab)
Ownership
Palo Alto Networks announced on July 22, 2025 that it completed its acquisition of Protect AI. Source, checked October 21, 2026: paloaltonetworks.com (opens in a new tab)
Open source
Yes: MIT Source, checked October 21, 2026: api.github.com (opens in a new tab)
Repository
github.com Source, checked October 21, 2026: api.github.com (opens in a new tab)
GitHub stars
3,217 as of October 21, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Latest push
July 8, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Latest release
Not documented in the sources we checked
Deployment
Library, Self-hosted, API Source, checked October 21, 2026: github.com (opens in a new tab)
Pricing model
Free Source, checked October 21, 2026: github.com (opens in a new tab)
Website
protectai.github.io Source, checked October 21, 2026: protectai.github.io (opens in a new tab)
Documentation
protectai.github.io Source, checked October 21, 2026: protectai.github.io (opens in a new tab)
API reference
Not documented in the sources we checked
Quickstart
protectai.github.io Source, checked October 21, 2026: protectai.github.io (opens in a new tab)
Security page
Not documented in the sources we checked
Attestations or disclosure
Not documented in the sources we checked

Capabilities

As documented by the vendor or project. The tag is our label from a controlled vocabulary.

Where LLM Guard fits in our AI security layers

Our analysis

Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document. How the model works.

AI security layers that LLM Guard covers, with the role, how each applies and what it rests on
LayerRoleHow it appliesBased on
L6 Runtime Runtime guardrails Primary Screen what goes into and comes out of a model in live traffic, and limit abuse of the model endpoint. Follows its category, LLM firewalls & guardrails
L5 Data Data protection Also covers Documents anonymization of personal data in prompts and detection of secrets. Anonymizes personal data and detects secrets in prompts, and restores values in output with a Deanonymize scanner

OWASP LLM Top 10 mapping

Our analysis

The risk list is OWASP's (Top 10 for LLM Applications, 2025). The mapping is our analysis, and each row rests on a capability the sources document.

OWASP LLM risks mapped to LLM Guard, with the capabilities each mapping rests on
RiskHow it appliesBased on
LLM01 Prompt Injection A Prompt Injection input scanner screens prompts before they reach the model. Scans prompts for prompt injection with an input scanner
LLM02 Sensitive Information Disclosure Anonymize and Secrets scanners keep personal data and credentials out of prompts. Anonymizes personal data and detects secrets in prompts, and restores values in output with a Deanonymize scanner
LLM05 Improper Output Handling Output scanners check JSON structure and URLs in model responses. Checks model output for malicious URLs; Validates model output with JSON and regex scanners
LLM10 Unbounded Consumption A Token Limit scanner caps how long a prompt can be. Caps prompt length with a Token Limit input scanner

Not mapped in our analysis: LLM07, LLM09. These are risks we expect tools in this category to cover; the sources we checked do not document a matching capability.

Alternatives and related tools

More in LLM firewalls & guardrails, ranked within the category by Coverage Score.

NVIDIA NeMo Guardrails

NVIDIA

Open sourceApache-2.0
  • Library
  • Self-hosted
  • API

Adds programmable input, dialog, retrieval, execution and output rails to LLM applications.

Best for: Teams that want to script rules for one LLM application in Python and run them in their own infrastructure

Coverage Score 76 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM05 Improper Output Handling
  • LLM06 Excessive Agency

Reviewed

Portkey AI Gateway

Palo Alto Networks (Portkey)

Open sourceMIT Freemium Now Prisma AIRS AI Gateway
  • SaaS
  • Self-hosted
  • API

Routes LLM traffic through one gateway API and runs input and output guardrail checks on each request.

Best for: Teams that want a single gateway for several LLM providers with guardrail checks, available as open source or as a hosted service

Coverage Score 69 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM05 Improper Output Handling
  • LLM09 Misinformation

Reviewed

Kong AI Gateway

Kong

Open sourceApache-2.0
  • Self-hosted
  • SaaS
  • API

Routes LLM traffic through Kong with prompt guards, PII sanitization, spend limits and observability.

Best for: Teams that already run Kong as an API gateway and want LLM routing and prompt controls on the same data plane

Coverage Score 65 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM10 Unbounded Consumption

Reviewed

Head-to-head comparisons

LLM Guard FAQ

Is LLM Guard open source?

Yes. It is released under the MIT license, and the code is on GitHub at protectai/llm-guard.

Is LLM Guard still maintained?

The README says the project is archived and no longer under active development or maintained, and the GitHub repository is archived and read-only.

Who owns LLM Guard?

It comes from Protect AI. Palo Alto Networks announced on July 22, 2025 that it had completed its acquisition of Protect AI.

Key facts you can cite

We have no commercial relationship with Palo Alto Networks (Protect AI).

Sources & last reviewed

Last reviewed . We compile from the vendors' own public pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.