OpenGuardrailsOpenGuardrails

For humans

Your agent can be wrong, or turned against you. Catch it before it acts.

The more you let an agent do, the more one bad model output can cost. OpenGuardrails checks each action before it runs, so you stop being asked about the safe ones and hear about the ones that matter.

Install it, freeRead the code ↗

What it protects you from

Four ways an agent goes wrong

Hallucination

Your agent is certain of something false: a package that does not exist, a path, that you asked for this. Then it acts on it.

Open source, today
Rules refuse the destructive and credential-reading actions whatever the agent believes.
With the model
The judge asks whether the action is safe and within what you asked, and refuses it if not.
Where it stops
It judges actions. A confident wrong sentence in a reply is not an action.

Poisoned model weights

A backdoored model behaves until a trigger appears, then emits a harmful tool call.

Open source, today
Rules do not ask the model. They read the tool call it produced, so bad weights cannot talk their way past them.
With the model
A separate model judges the action, so the weights you run never vouch for themselves.
Where it stops
It does not scan weights. It catches what they make your agent do.

Malicious API relay

A cheap model relay can harvest the keys in your requests, or rewrite replies to add tool calls of its own.

Open source, today
Secrets become placeholders before a request leaves your machine, side requests included. Tool calls in the reply go through the rules on the way back.
With the model
Tool calls that come back and that rules cannot decide are judged too.
Where it stops
The relay still reads your conversation. A secret the rules do not recognize is not masked.

External prompt injection

A web page, an issue or an email tells your agent to send your data somewhere. The agent reads it as an instruction.

Open source, today
Reads of credentials are refused, and openguardrails run records every connection, including hosts no tool call named.
With the model
Tool output is never sent to the judge, so the injected text cannot argue with it. The judge looks at what the agent does next.
Where it stops
Without the model, an action the rules cannot decide is left to the agent's own permission check.

Install

Two ways. The same result.

Have your agent do it

Paste this to your agent. It will show you each change first.

Install OpenGuardrails on this machine, following
https://openguardrails.com/agents.md
Show me every change before you make it, and tell me
plainly what is and is not protected when you finish.

Or do it yourself

Needs Node 22.12 or newer.

  1. 1. install
    git clone https://github.com/openguardrails/openguardrails
cd openguardrails/cli && npm install && npm run build && npm link
  2. 2. ~/.openguardrails/config.json, mode 0600
    {
  "workspaces": ["/absolute/path/to/your/work"],
  "gateway": {
    "upstreams": {
      "main": {
        "baseURL": "https://openrouter.ai/api/v1",
        "model": "qwen/qwen3.8-27b",
        "apiKeyEnv": "OPENROUTER_API_KEY"
      }
    },
    "routes": { "auto": ["main"] }
  }
}
  3. 3. start
    openguardrails serve    # the local gateway, on port 4180
openguardrails status   # checks the service and every upstream
  4. 4. point your agent at it
    base URL   http://127.0.0.1:4180/v1
model      auto
API key    any string

Works the same for every agent. See what happened with openguardrails decisions. Exactly what was sent to the model is in ~/.openguardrails/model-requests.ndjson. Sandbox a run with openguardrails run -- <command>.

Early, and honest about it

What is not here yet

The public model API
Tested with the real model through all three agents, but not deployed. Until then, what the rules cannot decide is logged as unjudged and left to the agent's own permission check. Pro and Max open with it.
The npm package
Install from a checkout for now. The package on npm today is an older version.
Asking you on your phone
A decision that is yours comes back to you through the agent.

The full list, including what a refusal can do to a turn: What it does not do yet. For a company, AIRS runs the model judges today.

Real harness, through the gatewayRules and model enforcedAgent told whySecrets kept from the providerTool gets the real value
Hermes 0.20✓✓✓✓
OpenClaw 2026.6✓✓✓✓
DeepSeek Harness 0.2✓✓✓✓

Why believe us

Published, and open to check.

PaperThe technical reportOne guard model for content safety and manipulation detection, across 119 languages, with the highest average F1 in all six evaluations.Read the research →CodeOpen source, Apache-2.0Rules, gateway, sandbox and firewall. Read the code that decides, starting at cli/src/gate/gate.ts.GitHub ↗ModelsOpen guard modelsOpenGuardrails-Text, 3.3B and 4B parameters, for content safety and prompt attack detection. Download and run them yourself.Hugging Face ↗