GuardEx

A Python SDK that screens LLM inputs and outputs for PII, prompt injection, unsafe content, topic drift, and hallucinations. Run it in-process, or self-host the same pipeline as an HTTP API.

Two lines around your existing call. No account, no vendor API.

$ pip install 'guardex-ai[local]'
Quickstart

Works the same with Gemini, OpenAI, Anthropic, or any model provider.

from guardex import Guard

guard = Guard()  # zero config

result = guard.screen(
    user_msg, gate="input",
)

if result.blocked:
    print(result.classify.category)
else:
    if result.pii.has_pii:
        n = len(result.pii.entities)
        print(f"masked {n} entities")
    print(result.text)
~20 ms
safety check, warm, M2
31
PII entity types
S0 to S14
safety categories
0
vendor API calls, local mode

Where GuardEx sits

A safety layer between your app and your LLM. No proxy, no infra changes.

Your app
FastAPI, Flask, Django
SDK
GuardEx
Injection
Safety
PII
Grounding
Your LLM
Gemini, OpenAI, local
What you send Screening
Model sees
Personal data

The models download once, then run offline in your process

What GuardEx catches

Every check is its own layer. Turn off the ones you don't need.

Safety engine
Safety classification
An ONNX toxicity gate, always on. Add Ollama and you get full S1 to S14 category verdicts from LlamaGuard 3.
Prompt injection
31 regex patterns for the injection and jailbreak shapes that keep showing up, checked before the model sees the text.
Privacy
PII detection
31 entity types via GLiNER. Add your own labels and regex for medical record numbers or employee IDs.
PII vault
Reversible tokens, so the model sees placeholders and the user still gets the real value back, even across stream chunks.
Scope
Topic scope
Name the topics your assistant is for and how wide that scope runs. When enabled, out-of-scope requests are refused, scored by embedding similarity.
Custom safety routes
Your own blocklist categories, defined by a handful of example utterances. No fine-tuning, no retraining.
Control
Grounding
Splits an answer into claims and scores each against your retrieved sources. Opt in, adds roughly 700 MB of models.
Bring your own model
Point guardex.yaml at your own fine-tune or any compatible repo. A replacement classifier must be a compatible ONNX one.

Built for real-world AI risks

Concrete problems GuardEx solves today.

[CARD]
Customer support bots
RiskUsers paste card numbers and addresses straight into chat
FixGuardEx masks PII before it reaches the LLM and restores it in the reply
MRN-4820193
Document summarisation
RiskInternal docs contain medical record numbers, employee IDs, salary data
FixCustom regex patterns catch your own identifiers alongside the 31 built-in types
ANSWER
!
no match
RAG assistants
RiskThe model states something confidently that your sources never said
FixGrounding returns the specific sentences that failed, not just a flag

Setup

Configuration

The defaults get you running. These are the three things people change once it is in a real product.

Custom PII

Identifiers only you have

The 31 built-in types cover emails, phones, cards and names. For identifiers specific to your company, add a label and a regex.

  • Detected, scored and masked like any built-in type
  • Same behaviour in local mode and server mode
  • Pair it with the vault to restore real values
Custom regex docs
from guardex import Guard, GuardExPolicy

policy = GuardExPolicy(
    pii_action="mask",
    pii_threshold=0.85,
    pii_custom_regex={
        "MRN": r"\bMRN-\d{7}\b",
        "EMP_ID": r"\bEMP\d{5}\b",
    },
)

guard = Guard(policy=policy)
Models

Bring your own model

Nothing here is pinned. Point guardex.yaml at your own fine-tune or any compatible repo, and GuardEx falls back to the defaults if the file is absent.

  • Classifier, PII and embedding models are all swappable
  • A replacement classifier must be a compatible ONNX one
  • GUARDEX_* environment variables override the file
Configuration guide
# guardex.yaml
models:
  classifier:
    AtliQ-Technologies/toxicity-fast-onnx
  pii: nvidia/gliner-pii
  embeddings:
    sentence-transformers/all-MiniLM-L6-v2
  ollama_model: llama-guard3:1b

cache_dir: ~/.cache/guardex
RAG

Checking answers against your sources

The failure mode in RAG is not an unsafe answer but a confident one your documents never supported. Grounding splits the reply into claims and scores each against your sources.

  • A setting, not a separate install: one env var on top of [local]
  • DeBERTa NLI and embeddings, hybrid scored, about 700 MB
  • Returns the specific sentences that failed, not just a flag
screen_grounded() reference
# GUARDEX_GROUNDING_ENABLED=1

screen, grounding = guard.screen_grounded(
    response_text=llm_response,
    sources=retrieved_chunks,
    gate="output",
    grounding_mode="accuracy",
)

for s in grounding.hallucinated_sentences:
    flag_for_review(s.sentence)

Install what you need

Apache 2.0, free forever. Extras are opt in because they pull extra models.

Core
$pip install guardex-ai
Lightweight, no models
  • Prompt injection patterns
  • Client for a GuardEx server
  • Policy engine and vault
Recommended
Local
$pip install 'guardex-ai[local]'
About 250 MB of models
  • Everything in Core
  • ONNX safety classifier
  • GLiNER PII detection
  • Topic scope and custom routes
Server
$pip install 'guardex-ai[local,server]'
Self-hosted
  • FastAPI reference server
  • Same policy as local mode
  • Ships with no auth, put it behind your own proxy

Not in scope: images, audio or video, RBAC, non-English patterns, remote policy hot-reload, and a hosted service. Package on PyPI    Full list on GitHub

FAQ

Does text leave the machine?

Not in local mode. The models run in your process, and the only network traffic is the one-time model download on the first Guard() call. In server mode it goes to the GuardEx server you host, and nowhere else.

How big are the models?

Around 250 MB, cached in ~/.cache/guardex and ~/.cache/huggingface. Turning on grounding adds roughly 700 MB more, which is why it is opt in.

Can I add my own PII patterns?

Yes. Pass pii_custom_regex to GuardExPolicy with your label and pattern. They run alongside the 31 built-in types, in both local and server mode.

Can I swap in my own models?

Yes. guardex.yaml points the classifier, PII detector and embedding model at other HuggingFace repos, and ollama_model at whichever guard model you serve. A replacement classifier has to be a compatible ONNX one.

Do I need Ollama?

Only for per-category S1 to S14 verdicts. Without it GuardEx falls back to the ONNX fast gate, logs one warning, and carries on.

Can I use this in a commercial product?

Yes. Apache 2.0 covers commercial use, modification and redistribution. No key to buy, no usage limits, no hosted tier. Just keep the license text with any copy you ship.

Get started

Install it, create a Guard(), screen the input and the output. Apache 2.0, so read the source and change what you need.

$ pip install 'guardex-ai[local]'
Read it on GitHub

Maintained by

AtliQ Technologies builds data and AI systems, and maintains GuardEx as an open-source project under Apache 2.0. Issues and pull requests are welcome on GitHub.