Open-source LLM security gateway
Catch prompt injection and data exfiltration — and prove the rate.
promptward is a wire-compatible gateway you put in front of the model. A fast Rust core scans every request in and out, blocks or redacts on policy, validates structured output, and meters cost — and it ships the eval harness that measures how well the detection actually works, on public benchmarks.
Measured detection, not asserted
The headline numbers come from a labeled 171-example corpus (`pnpm eval`, reproducible). But a corpus you wrote only proves so much — so the same detector is run over third-party, field-cited benchmarks it was never tuned on, and the honest results are published, failures included.
| Benchmark | Rows | Recall | Precision | False-pos |
|---|---|---|---|---|
| deepset/prompt-injections | 662 | 8.7% | 92.0% | 0.5% |
| Lakera Gandalf (all-attack) | 1000 | 61.2% | — | — |
| safe-guard (test) | 2060 | 32.5% | 99.5% | 0.1% |
| NotInject (over-defense) | 339 | — | — | 0.9% |
The shape is deliberate and honest: precision and low false-alarm generalize (they hold even on NotInject, a set built to trigger over-defense), while recall is scoped to the override / smuggling / exfiltration patterns the detector targets — it misses roleplay jailbreaks, non-English injections, and pure social-engineering extraction. That is the correct trade for a $0, microsecond checkpoint you pair with an LLM-judge for the fuzzy tail. Full per-dataset breakdown lives in evals/external.
How it works
A thin checkpoint in front of the model
Point your SDK's baseURL at promptward. Every call is scanned inbound and outbound by a Rust core, gated by policy (allow / redact / block), passed through to Anthropic or OpenAI, validated against your JSON Schema, and recorded with tokens and cost.
Built for the 2026 attack surface
Not 2024's "ignore your instructions": indirect injection in fetched documents and tool output, MCP tool-description poisoning, invisible unicode-tag and variation-selector smuggling, and markdown-image links that exfiltrate with zero tool calls.
- Deterministic Rust core — NFKC-normalize and reveal smuggling, decode-then-rescan base64/hex/rot13 and variation-selector payloads, then source-aware injection and value-shape secret/PII detection. No model call, so $0 and tens of microseconds.
- Catches 9 documented evasions where commercial detectors fail — and the one it initially missed (emoji / variation-selector smuggling, which hit 100% bypass on Azure Prompt Shield) was found by the eval suite and closed. That loop is the point.
- Self-hostable — run the detection in your own VPC, see exactly what fired, prove the rate.
Quickstart
# clone, build the Rust detection core, run the proof git clone https://github.com/johncarmack1984/promptward cd promptward pnpm install pnpm core:build # build the napi detection core pnpm eval # reproduce the detection numbers pnpm gateway # start the proxy (in-memory; no setup)
Then point any OpenAI- or Anthropic-compatible client at it — it stays wire-compatible:
# Anthropic client = Anthropic(base_url="http://localhost:8787") # OpenAI client = OpenAI(base_url="http://localhost:8787/v1")