promptward

Open-source LLM security gateway

Catch prompt injection and data exfiltration — and prove the rate.

promptward is a wire-compatible gateway you put in front of the model. A fast Rust core scans every request in and out, blocks or redacts on policy, validates structured output, and meters cost — and it ships the eval harness that measures how well the detection actually works, on public benchmarks.

Measured detection, not asserted

100%
attack precision (internal corpus)
97.5%
recall @ 0 benign false positives
10/10
documented evasions caught
~0.02ms
p50 scan · $0 · no model call

The headline numbers come from a labeled 171-example corpus (`pnpm eval`, reproducible). But a corpus you wrote only proves so much — so the same detector is run over third-party, field-cited benchmarks it was never tuned on, and the honest results are published, failures included.

Public benchmarks — same detector, out-of-distribution data (pnpm eval:external)
BenchmarkRowsRecallPrecisionFalse-pos
deepset/prompt-injections6628.7%92.0%0.5%
Lakera Gandalf (all-attack)100061.2%
safe-guard (test)206032.5%99.5%0.1%
NotInject (over-defense)3390.9%

The shape is deliberate and honest: precision and low false-alarm generalize (they hold even on NotInject, a set built to trigger over-defense), while recall is scoped to the override / smuggling / exfiltration patterns the detector targets — it misses roleplay jailbreaks, non-English injections, and pure social-engineering extraction. That is the correct trade for a $0, microsecond checkpoint you pair with an LLM-judge for the fuzzy tail. Full per-dataset breakdown lives in evals/external.

How it works

A thin checkpoint in front of the model

Point your SDK's baseURL at promptward. Every call is scanned inbound and outbound by a Rust core, gated by policy (allow / redact / block), passed through to Anthropic or OpenAI, validated against your JSON Schema, and recorded with tokens and cost.

Built for the 2026 attack surface

Not 2024's "ignore your instructions": indirect injection in fetched documents and tool output, MCP tool-description poisoning, invisible unicode-tag and variation-selector smuggling, and markdown-image links that exfiltrate with zero tool calls.

  • Deterministic Rust core — NFKC-normalize and reveal smuggling, decode-then-rescan base64/hex/rot13 and variation-selector payloads, then source-aware injection and value-shape secret/PII detection. No model call, so $0 and tens of microseconds.
  • Catches 9 documented evasions where commercial detectors fail — and the one it initially missed (emoji / variation-selector smuggling, which hit 100% bypass on Azure Prompt Shield) was found by the eval suite and closed. That loop is the point.
  • Self-hostable — run the detection in your own VPC, see exactly what fired, prove the rate.

Quickstart

# clone, build the Rust detection core, run the proof
git clone https://github.com/johncarmack1984/promptward
cd promptward
pnpm install
pnpm core:build      # build the napi detection core
pnpm eval            # reproduce the detection numbers
pnpm gateway         # start the proxy (in-memory; no setup)

Then point any OpenAI- or Anthropic-compatible client at it — it stays wire-compatible:

# Anthropic
client = Anthropic(base_url="http://localhost:8787")
# OpenAI
client = OpenAI(base_url="http://localhost:8787/v1")