Guardrails for every builder and agent
The default guardrails
for agents.
OpenGuardrails sits between an agent and everything it can reach. Open source, and it runs on your machine.
If you are a humanLet your agent do more, and walk away.Hallucinations, poisoned model weights, malicious API relays and prompt injection all end the same way: an action you never asked for. OpenGuardrails checks the action before it runs, and keeps your keys from the model provider.Protect your machine →$ whoami # an agentGet trusted with more.A human hands over wider permissions and real keys to an agent they can check on. OpenGuardrails gives them something to check: every action decided, every decision on record, and keys you can use without the model provider ever seeing them.Read /agents.md →
A real run
The model never saw the key. The tool still got it.
From the OpenGuardrails gateway in front of a scripted model, on a fake key. Your agent changes one setting, its base URL, and needs no plugin.
the same request, at each hop
# what the agent was told deploy with sk-proj-LABFAKE0123… # what the model provider received, and answered with deploy --token OGRKP5000001 # what the tool call carries when it comes back to your machine deploy --token sk-proj-LABFAKE0123… # and when the model asks for your private key terminal: cat ~/.ssh/id_rsa refused reading a private key or cloud credential into the model's context
How it decides
Rules first. A model only for what rules cannot tell.
Most of what an agent does is safe, and a rule can tell, with no network and no model. A rule allows only what it fully understands and only what stays on the machine.
- Allowgit status, reading or changing a file in the workspace
- Refuserm -rf /, reading ~/.ssh/id_rsa, cloud metadata endpoints. The agent is told why and carries on.
- Cannot tellNetwork, installs, git push, unknown tools go to a model built to judge agent actions.
- Yours to decideSafe, but your call, like a purchase. The agent asks you. A security risk is never sent to you to approve.
Why believe us
Published, and open to check.
PaperThe technical reportOne guard model for content safety and manipulation detection, across 119 languages, with the highest average F1 in all six evaluations.Read the research →CodeOpen source, Apache-2.0Rules, gateway, sandbox and firewall. Read the code that decides, starting at cli/src/gate/gate.ts.GitHub ↗ModelsOpen guard modelsOpenGuardrails-Text, 3.3B and 4B parameters, for content safety and prompt attack detection. Download and run them yourself.Hugging Face ↗
| Real harness, through the gateway | Rules and model enforced | Agent told why | Secrets kept from the provider | Tool gets the real value |
|---|---|---|---|---|
| Hermes 0.20 | ✓ | ✓ | ✓ | ✓ |
| OpenClaw 2026.6 | ✓ | ✓ | ✓ | ✓ |
| DeepSeek Harness 0.2 | ✓ | ✓ | ✓ | ✓ |
Tested against the real harnesses with scripted models, in cli/experiments. Early, and honest about it: what it does not do yet.
One path, from one machine to the whole company
Start free. Nothing to rip out later.
StartOpenGuardrails for BuilderFree and open sourceFor builders and agents: local rules, key masking, gateway, sandbox and firewall on your machine.Install →GrowOpenGuardrails Pro and MaxFrom $20 / monthMore quota for the OpenGuardrails model, which judges what rules cannot decide. Opens with the public model API.See plans →EnterpriseOpenGuardrails AIRSFrom $1,000 / monthUnified AI Security Platform for enterprises: runtime, endpoint, supply chain and red teaming security, AI Gateway and AI Firewall / Proxy. A separate product from open source Builder.Enterprise →
AIRS customer? Sign in to the console.