AI Defense Stack

LLM firewalls & guardrails

NVIDIA NeMo Guardrails: open-source programmable guardrails toolkit

NeMo Guardrails is an open-source programmable guardrails toolkit from NVIDIA. It is released under the Apache-2.0 license and is offered as: Library, Self-hosted, API.

  • Last reviewed
Visit NeMo Guardrails (opens in a new tab) Documentation (opens in a new tab) Source code (opens in a new tab)
Open sourceApache-2.0 Layer 6: Runtime guardrails

Best for

Teams that want to script rules for one LLM application in Python and run them in their own infrastructure

Consider instead if

  • You want to scan a model for weaknesses before release instead of filtering live traffic. See garak.
  • You prefer a hosted API over running the guardrails yourself. See Lakera Guard.

What NeMo Guardrails does

NVIDIA NeMo Guardrails is an open-source Python toolkit for adding programmable guardrails to LLM-based applications. You define rails that run on user input, retrieved content, dialog flow, tool calls and model output, and you can write dialog rules in the Colang modeling language. The documentation lists content safety checks, jailbreak protection, topic control, personal data detection and checks on agent tool calls. You can use it as a library inside your own code, run it as a FastAPI server, or deploy it in a container. It is free under the Apache-2.0 license and the repository publishes security-reporting instructions. It shapes the behavior of one application; it does not test models before release.

This summary is our own wording of the sourced facts on this page.

Key facts

Each value links to the page that states it, with the date we checked it.

Vendor
NVIDIA Source, checked October 21, 2026: github.com (opens in a new tab)
Status
Active Source, checked October 21, 2026: api.github.com (opens in a new tab)
Open source
Yes: Apache-2.0 Source, checked October 21, 2026: github.com (opens in a new tab)
Repository
github.com Source, checked October 21, 2026: github.com (opens in a new tab)
GitHub stars
7,341 as of October 21, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Latest push
October 22, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Latest release
September 16, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Deployment
Library, Self-hosted, API Source, checked October 21, 2026: docs.nvidia.com (opens in a new tab)
Pricing model
Free Source, checked October 21, 2026: github.com (opens in a new tab)
Website
docs.nvidia.com Source, checked October 21, 2026: docs.nvidia.com (opens in a new tab)
Documentation
docs.nvidia.com Source, checked October 21, 2026: docs.nvidia.com (opens in a new tab)
API reference
Not documented in the sources we checked
Quickstart
docs.nvidia.com Source, checked October 21, 2026: docs.nvidia.com (opens in a new tab)
Security page
github.com Source, checked October 21, 2026: github.com (opens in a new tab)
Attestations or disclosure
Vulnerability reports are handled through NVIDIA PSIRT Source, checked October 21, 2026: github.com (opens in a new tab)

Capabilities

As documented by the vendor or project. The tag is our label from a controlled vocabulary.

Integrations

Where NeMo Guardrails fits in our AI security layers

Our analysis

Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document. How the model works.

AI security layers that NeMo Guardrails covers, with the role, how each applies and what it rests on
LayerRoleHow it appliesBased on
L6 Runtime Runtime guardrails Primary Screen what goes into and comes out of a model in live traffic, and limit abuse of the model endpoint. Follows its category, LLM firewalls & guardrails
L7 Agent access Agent and tool access Also covers Documents execution rails that check tool calls. Validates tool inputs and outputs around tool calls (execution rails)
L5 Data Data protection Also covers Documents masking of personal data. Detects and masks personal data in inputs, outputs and retrieved content

OWASP LLM Top 10 mapping

Our analysis

The risk list is OWASP's (Top 10 for LLM Applications, 2025). The mapping is our analysis, and each row rests on a capability the sources document.

OWASP LLM risks mapped to NeMo Guardrails, with the capabilities each mapping rests on
RiskHow it appliesBased on
LLM01 Prompt Injection Jailbreak protection screens adversarial prompts before they reach the model. Detects jailbreak and adversarial prompts using self-check, heuristic patterns, NemoGuard or third-party services
LLM02 Sensitive Information Disclosure Detects and masks personal data in inputs, outputs and retrieved content. Detects and masks personal data in inputs, outputs and retrieved content
LLM05 Improper Output Handling Output rails check model responses before they reach the user. Checks model responses before they reach the user (output rails)
LLM06 Excessive Agency Execution rails validate the inputs and outputs of tool calls. Validates tool inputs and outputs around tool calls (execution rails)

Not mapped in our analysis: LLM07, LLM09, LLM10. These are risks we expect tools in this category to cover; the sources we checked do not document a matching capability.

Alternatives and related tools

More in LLM firewalls & guardrails, ranked within the category by Coverage Score.

Portkey AI Gateway

Palo Alto Networks (Portkey)

Open sourceMIT Freemium Now Prisma AIRS AI Gateway
  • SaaS
  • Self-hosted
  • API

Routes LLM traffic through one gateway API and runs input and output guardrail checks on each request.

Best for: Teams that want a single gateway for several LLM providers with guardrail checks, available as open source or as a hosted service

Coverage Score 69 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM05 Improper Output Handling
  • LLM09 Misinformation

Reviewed

Kong AI Gateway

Kong

Open sourceApache-2.0
  • Self-hosted
  • SaaS
  • API

Routes LLM traffic through Kong with prompt guards, PII sanitization, spend limits and observability.

Best for: Teams that already run Kong as an API gateway and want LLM routing and prompt controls on the same data plane

Coverage Score 65 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM10 Unbounded Consumption

Reviewed

Amazon Bedrock Guardrails

Amazon Web Services

Commercial
  • API
  • Cloud-native
  • Managed service

AWS service that filters harmful content, prompt attacks, denied topics and PII in model inputs and outputs.

Best for: Teams that already build on AWS and want managed filters they can apply to Bedrock models or to other models through an API call

Coverage Score 60 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM05 Improper Output Handling
  • LLM09 Misinformation

Reviewed

Head-to-head comparisons

NeMo Guardrails FAQ

Is NVIDIA NeMo Guardrails open source?

Yes. It is released under the Apache-2.0 license, and the code is on GitHub at NVIDIA-NeMo/Guardrails.

What kinds of rails does NeMo Guardrails offer?

The documentation lists input, retrieval, dialog, execution and output rails.

Can NeMo Guardrails run as a server?

Yes. The installation guide lists a Guardrails API server built on FastAPI and a Docker deployment, besides use as a Python library.

Key facts you can cite

We have no commercial relationship with NVIDIA.

Sources & last reviewed

Last reviewed . We compile from the vendors' own public pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.