# Guard — Hanzo AI

> Stop prompt injection, PII leaks, and unsafe outputs before they reach your users.

hanzoai/guard

# Guard

It reads what goes into a model, and what comes back

People paste their social security number into a chat box. Guard catches it on the way out and replaces it before the model ever sees it, then reads the reply on the way back. It runs three ways: as a proxy in front of an LLM API, as a wrapper around a command-line tool, or as a filter in front of an MCP server. A Rust library and a Unix pipe if you would rather not run a process at all.

[Get started](https://docs.hanzo.ai/docs/services/guard)[View on GitHub](https://github.com/hanzoai)

## What it looks for

Detectors you can read, thresholds you can move, and no claim to understand meaning. Guard is the first layer, not the only one.

### Six shapes an injection takes

Overriding the instructions, role-play, asking for the system prompt, bypassing a rule, hiding the ask in an encoding, and reframing the context. A match returns a confidence rather than a verdict, and you decide what confidence is worth blocking.

### The things people paste by accident

Social security numbers, card numbers checked against the Luhn digit so a phone number is not mistaken for one, emails, phone numbers, IP addresses, and provider API keys. Each becomes a typed marker, so the model still knows a card number was there and does not lose the sentence.

### Both directions, on purpose

The reply is read with the same detectors as the request, because the leak that matters is usually the one coming back. A machine-learning classifier for categories like violence and self-harm is available and off unless you turn it on — pattern matching is the default because it is the part that behaves the same every time.

### You set the dials

Turn each detector on or off, set the injection threshold, add your own patterns for whatever is sensitive in your domain, and choose the marker text. Requests are rate limited per user with a token bucket, so a single caller cannot burn the budget.

### A log that is not a second copy of the leak

Decisions are written as JSON lines with a hash of the content, not the content. Logging what you just redacted would put it in a file with weaker access control than the one you took it out of. Turn content logging on deliberately, or leave it off.

### Nothing to rewrite

Start the proxy with your provider as the upstream and point the base URL at it. Or wrap a CLI tool over a pseudo-terminal and everything you type is filtered on its way in. Or put it in front of an MCP server and filter the tool calls.

## Get started with Guard

[Read the docs](https://docs.hanzo.ai/docs/services/guard)[View on GitHub](https://github.com/hanzoai)

## Open source

License: Apache-2.0[hanzoai](https://github.com/hanzoai)

## Get Guard

AI guardrails

[Deploy to Cloud](https://console.hanzo.ai/deploy)[Self-host](https://docs.hanzo.ai/docs/services/guard)