AI Defense Stack

LLM firewalls & guardrails

Meta Llama Protections: open suite of LLM safety models and tools

Llama Protections is an open suite of LLM safety models and tools from Meta. It is released under a open, custom license and is offered as: Library, Self-hosted.

  • Last reviewed
Visit Llama Protections (opens in a new tab) Documentation (opens in a new tab) Source code (opens in a new tab)
Open, custom license Layer 6: Runtime guardrails

Best for

Teams that want open-weights safety classifiers and an agent guardrail framework they can run in their own infrastructure

Consider instead if

  • You want programmable dialog rails written in Python rather than separate model files. See NeMo Guardrails.
  • You prefer a hosted API over downloading and serving models yourself. See Lakera Guard.

What Llama Protections does

Meta Llama Protections is Meta's set of open safety tools for LLM applications. Llama Guard is a moderation model that screens text and images in prompts and responses. Prompt Guard 2 is a pair of classifiers for prompt injection and jailbreaks. LlamaFirewall is a framework that coordinates several guard models and scanners for agents, and CodeShield filters insecure code from model output. The code lives in the PurpleLlama repository, where the README says evaluations and benchmarks are MIT licensed and models use the matching Llama Community license. You download and run the pieces yourself, and the repository license grant is royalty-free. Meta's page advises combining them with other safeguards because no single guardrail covers every risk.

This summary is our own wording of the sourced facts on this page.

Key facts

Each value links to the page that states it, with the date we checked it.

Vendor
Meta Source, checked October 21, 2026: meta-llama.github.io (opens in a new tab)
Status
Active Source, checked October 21, 2026: api.github.com (opens in a new tab)
Open source
Yes: Custom Source, checked October 21, 2026: github.com (opens in a new tab)
Repository
github.com Source, checked October 21, 2026: github.com (opens in a new tab)
GitHub stars
4,444 as of October 21, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Latest push
October 12, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Latest release
Not documented in the sources we checked
Deployment
Library, Self-hosted Source, checked October 21, 2026: github.com (opens in a new tab)
Pricing model
Free Source, checked October 21, 2026: github.com (opens in a new tab)
Website
dev.meta.ai Source, checked October 21, 2026: dev.meta.ai (opens in a new tab)
Documentation
meta-llama.github.io Source, checked October 21, 2026: meta-llama.github.io (opens in a new tab)
API reference
Not documented in the sources we checked
Quickstart
github.com Source, checked October 21, 2026: github.com (opens in a new tab)
Security page
Not documented in the sources we checked
Attestations or disclosure
Not documented in the sources we checked

Capabilities

As documented by the vendor or project. The tag is our label from a controlled vocabulary.

Where Llama Protections fits in our AI security layers

Our analysis

Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document. How the model works.

AI security layers that Llama Protections covers, with the role, how each applies and what it rests on
LayerRoleHow it appliesBased on
L6 Runtime Runtime guardrails Primary Screen what goes into and comes out of a model in live traffic, and limit abuse of the model endpoint. Follows its category, LLM firewalls & guardrails
L7 Agent access Agent and tool access Also covers Documents AlignmentCheck, which audits agent reasoning to catch goal hijacking. Audits agent reasoning for goal hijacking with the LlamaFirewall AlignmentCheck module

OWASP LLM Top 10 mapping

Our analysis

The risk list is OWASP's (Top 10 for LLM Applications, 2025). The mapping is our analysis, and each row rests on a capability the sources document.

OWASP LLM risks mapped to Llama Protections, with the capabilities each mapping rests on
RiskHow it appliesBased on
LLM01 Prompt Injection Prompt Guard 2 classifiers detect prompt injections and jailbreaks. Detects prompt injections and jailbreaks with the Prompt Guard 2 classifiers; Detects jailbreak attempts with the Prompt Guard 2 classifiers
LLM05 Improper Output Handling CodeShield filters insecure code in model output before it is used. Filters insecure code generated by an LLM at inference time with CodeShield
LLM06 Excessive Agency AlignmentCheck audits agent reasoning to flag goal hijacking. Audits agent reasoning for goal hijacking with the LlamaFirewall AlignmentCheck module

Not mapped in our analysis: LLM02, LLM07, LLM09, LLM10. These are risks we expect tools in this category to cover; the sources we checked do not document a matching capability.

Alternatives and related tools

More in LLM firewalls & guardrails, ranked within the category by Coverage Score.

NVIDIA NeMo Guardrails

NVIDIA

Open sourceApache-2.0
  • Library
  • Self-hosted
  • API

Adds programmable input, dialog, retrieval, execution and output rails to LLM applications.

Best for: Teams that want to script rules for one LLM application in Python and run them in their own infrastructure

Coverage Score 76 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM05 Improper Output Handling
  • LLM06 Excessive Agency

Reviewed

Portkey AI Gateway

Palo Alto Networks (Portkey)

Open sourceMIT Freemium Now Prisma AIRS AI Gateway
  • SaaS
  • Self-hosted
  • API

Routes LLM traffic through one gateway API and runs input and output guardrail checks on each request.

Best for: Teams that want a single gateway for several LLM providers with guardrail checks, available as open source or as a hosted service

Coverage Score 69 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM05 Improper Output Handling
  • LLM09 Misinformation

Reviewed

Kong AI Gateway

Kong

Open sourceApache-2.0
  • Self-hosted
  • SaaS
  • API

Routes LLM traffic through Kong with prompt guards, PII sanitization, spend limits and observability.

Best for: Teams that already run Kong as an API gateway and want LLM routing and prompt controls on the same data plane

Coverage Score 65 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM10 Unbounded Consumption

Reviewed

Llama Protections FAQ

Is Meta Llama Protections open source?

Partly. The PurpleLlama README says evals and benchmarks are MIT licensed while models use the corresponding Llama Community license, so check the license for each piece you use.

What is in Meta Llama Protections?

Meta's page lists Llama Guard, Prompt Guard 2, LlamaFirewall, CodeShield and the CyberSecEval benchmark suite.

Does it replace other safeguards?

No. Meta's page cautions that no single guardrail covers every risk and recommends combining these tools with other safeguards.

Key facts you can cite

We have no commercial relationship with Meta.

Sources & last reviewed

Last reviewed . We compile from the vendors' own public pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.