A Python SDK that screens LLM inputs and outputs for PII, prompt injection, unsafe content, topic drift, and hallucinations. Run it in-process, or self-host the same pipeline as an HTTP API.
Two lines around your existing call. No account, no vendor API.
$ pip install 'guardex-ai[local]'
Works the same with Gemini, OpenAI, Anthropic, or any model provider.
from guardex import Guard guard = Guard() # zero config result = guard.screen( user_msg, gate="input", ) if result.blocked: print(result.classify.category) else: if result.pii.has_pii: n = len(result.pii.entities) print(f"masked {n} entities") print(result.text)
from google import genai from guardex import Guard guard = Guard() client = genai.Client() # before it reaches the model safe = guard.screen( user_msg, gate="input", ) reply = client.models.generate_content( model="gemini-2.5-flash", contents=safe.text, ).text # before it reaches the user out = guard.screen(reply, gate="output")
# needs GUARDEX_GROUNDING_ENABLED=1 def check(guard, reply, sources): out = guard.screen_grounded( response_text=reply, sources=sources, gate="output", grounding_mode="accuracy", ) screen, ground = out if screen.blocked: return "I can't help with that." bad = ground.hallucinated_sentences for s in bad: flag_for_review(s.sentence)
import asyncio from guardex import Guard, PIIVault async def main(): vault = PIIVault() async with Guard() as guard: r = await guard.ascreen( msg, gate="input", ) # tokens survive chunk splits async for c in guard.astream( stream, vault=vault, restore_mode="buffered", ): send(c) asyncio.run(main())
A safety layer between your app and your LLM. No proxy, no infra changes.
The models download once, then run offline in your process
Every check is its own layer. Turn off the ones you don't need.
Concrete problems GuardEx solves today.
Setup
The defaults get you running. These are the three things people change once it is in a real product.
The 31 built-in types cover emails, phones, cards and names. For identifiers specific to your company, add a label and a regex.
from guardex import Guard, GuardExPolicy policy = GuardExPolicy( pii_action="mask", pii_threshold=0.85, pii_custom_regex={ "MRN": r"\bMRN-\d{7}\b", "EMP_ID": r"\bEMP\d{5}\b", }, ) guard = Guard(policy=policy)
Nothing here is pinned. Point guardex.yaml at your own fine-tune or any compatible repo, and GuardEx falls back to the defaults if the file is absent.
# guardex.yaml models: classifier: AtliQ-Technologies/toxicity-fast-onnx pii: nvidia/gliner-pii embeddings: sentence-transformers/all-MiniLM-L6-v2 ollama_model: llama-guard3:1b cache_dir: ~/.cache/guardex
The failure mode in RAG is not an unsafe answer but a confident one your documents never supported. Grounding splits the reply into claims and scores each against your sources.
# GUARDEX_GROUNDING_ENABLED=1 screen, grounding = guard.screen_grounded( response_text=llm_response, sources=retrieved_chunks, gate="output", grounding_mode="accuracy", ) for s in grounding.hallucinated_sentences: flag_for_review(s.sentence)
Apache 2.0, free forever. Extras are opt in because they pull extra models.
Not in scope: images, audio or video, RBAC, non-English patterns, remote policy hot-reload, and a hosted service. Package on PyPI Full list on GitHub
Not in local mode. The models run in your process, and the only network traffic is the one-time model download on the first Guard() call. In server mode it goes to the GuardEx server you host, and nowhere else.
Around 250 MB, cached in ~/.cache/guardex and ~/.cache/huggingface. Turning on grounding adds roughly 700 MB more, which is why it is opt in.
Yes. Pass pii_custom_regex to GuardExPolicy with your label and pattern. They run alongside the 31 built-in types, in both local and server mode.
Yes. guardex.yaml points the classifier, PII detector and embedding model at other HuggingFace repos, and ollama_model at whichever guard model you serve. A replacement classifier has to be a compatible ONNX one.
Only for per-category S1 to S14 verdicts. Without it GuardEx falls back to the ONNX fast gate, logs one warning, and carries on.
Yes. Apache 2.0 covers commercial use, modification and redistribution. No key to buy, no usage limits, no hosted tier. Just keep the license text with any copy you ship.
Install it, create a Guard(), screen the input and the output. Apache 2.0, so read the source and change what you need.
$ pip install 'guardex-ai[local]'