Runtime AI security
One guardrail layer between any agent and the LLM.
AIFenders is a drop-in, OpenAI-compatible proxy. Five rails — input, dialog, retrieval, execution, output — enforce declarative safety policy across the whole agent lifecycle. Swap one base_url and every call is firewalled: prompt injection, PII, unsafe tool calls, and egress leaks. Zero code change.
Maps to OWASP LLM Top 10 · MITRE ATLAS · NIST AI RMF · EU AI Act · ISO 42001 · DPDP · GDPR
WORKS WITH ANY OPENAI-COMPATIBLE PROVIDER — PLUS ANTHROPIC
One line to adopt
Point your base_url at AIFenders.
Keep your model, your SDK, your code. Swap the base URL and every request is firewalled through all five rails — with guardrail telemetry on every response.
# point any OpenAI SDK at AIFenders — nothing else changes from openai import OpenAI client = OpenAI( base_url="https://aifenders.com/v1", api_key=AIFENDERS_KEY, ) # every call now firewalled: injection, PII, tool-policy, egress resp = client.chat.completions.create( model="aifenders-gateway", messages=[{"role":"user","content":"Summarize this contract…"}], ) print(resp.aifenders) # guardrail telemetry rides along
The problem
LLMs and agents fail in production in ways a chatbot never did.
The moment a model can retrieve documents, call tools, and act autonomously, its attack surface explodes — and a single bad output becomes a breach, a leak, or a destructive action.
Prompt injection
Users and poisoned documents override your instructions to exfiltrate data or jailbreak the model.
PII & secret leakage
Cards, Aadhaar, API keys and tokens flow into prompts and back out in responses — often mid-stream.
Unsafe tool calls
Agents delete records, move money, and email data off-domain with no human in the loop.
Poisoned RAG
A single weaponized chunk retrieved into context hijacks the agent — the top real-world attack.
The solution
Five rails, one declarative policy.
Each rail is a guard stage in the request lifecycle. All behavior lives in a single policy.json — no Colang DSL to learn. Tumeryk / NeMo-class coverage, developer-native.
Input
Prompt-injection scoring + PII/secret masking before the model sees the text.
Dialog
Topic & SOP control — allowlist a scope or block off-limits subjects.
Retrieval
Scores every RAG chunk for indirect injection and masks PII in context.
Execution
Risk-scores every tool call; destructive ops route to human approval.
Output
Streaming egress verifier catches leaked secrets and echoed PII — mid-token.
See it work
A live attack, blocked — in 90 seconds.
Watch AIFenders firewall a real prompt injection, then walk the five rails, the published benchmark, and the OWASP mapping.
Solutions
Built for the people who answer for AI risk.
One control plane, three audiences — from the runtime firewall to the audit trail.
Security leaders
Stop prompt injection, data exfiltration, and unsafe tool use at runtime — with an append-only audit trail and OWASP / MITRE ATLAS tags on every decision.
AI platform teams
Ship agents faster behind one drop-in proxy. Per-team policies, bring-your-own model, sub-millisecond overhead, and zero code change to adopt.
Legal & compliance
Evidence for the EU AI Act, India DPDP, and GDPR: data minimization via masking, human-in-the-loop on risky actions, and framework-mapped logs.
Why AIFenders
Whole-lifecycle coverage, developer-native.
Most tools scan text in and out, or make you learn a rules DSL. AIFenders firewalls the entire agent lifecycle from a drop-in proxy — and publishes its numbers.
| Capability | AIFenders | NeMo / Colang | Prompt scanners | DIY |
|---|---|---|---|---|
| Drop-in OpenAI-compatible proxy | ✓ | — | partial | — |
| Declarative policy — no DSL | ✓ | Colang | ✓ | — |
| Tool-call policy + human-in-the-loop | ✓ | partial | — | — |
| Streaming egress verification | ✓ | — | partial | — |
| RAG indirect-injection guard | ✓ | ✓ | — | — |
| Published recall + false-positive + latency | ✓ | — | — | — |
| Bring-your-own model + self-host | ✓ | ✓ | varies | ✓ |
Proven, not promised
Published benchmarks. Auditor-ready mapping.
99.4% enforcement across 2,200 adversarial cases — with the over-defense rate and latency most vendors won't publish. Every rail decision carries the framework IDs your buyers' security teams already require.
Firewall your agents in one line.
Create a free account, get an API key, and point your base_url at AIFenders. Every call firewalled — no code change.