# PromptGuard - AI Firewall for LLM Security
# https://promptguard.co

# Product
PromptGuard is an AI security platform that protects applications using LLMs (OpenAI, Anthropic, Google Gemini, Cohere, AWS Bedrock) from prompt injection attacks, data leaks, and inappropriate content. It offers multiple integration methods to secure any GenAI app regardless of tech stack.

# Integration Methods (from easiest to most flexible)
1. Auto-instrumentation - promptguard.init() patches LLM SDKs. One line secures everything, including frameworks like LangChain, CrewAI, Vercel AI SDK.
- Framework support: LangChain, LangGraph, CrewAI, OpenClaw, Vercel AI SDK, Pydantic AI, OpenAI Agents SDK
2. Guard API - POST /api/v1/guard scans content directly without forwarding to LLMs.
3. HTTP Proxy - Change your base URL to https://api.promptguard.co. Drop-in replacement.
4. GitHub Code Security Scanner - Connect repos via GitHub App. AST-based scanning detects unprotected LLM calls with zero false positives and raises auto-fix PRs.

# Key Features
- Prompt injection detection and blocking (six-layer architecture: normalization + regex + ML + content safety + multi-turn drift detection + policy). Measured F1 = 0.887 [0.874-0.900] across 2,369 samples from 8 datasets, 5 independently published (4 at peer-reviewed venues); 99.1% precision, 80.3% recall, 1.01% false-positive rate (10 of 991 benign). 100/100 on our own evasion suite - an in-house suite, not an independent benchmark. These measure a static attacker; see https://docs.promptguard.co/security/detection-limits for what detection cannot do and which controls do not depend on it.
- PII detection & redaction (43 entity types with synthetic data replacement)
- Data exfiltration, toxicity, fraud, malware, and API key leak detection
- AI agent security (tool call validation, behavior monitoring)
- Capability containment: a fail-closed envelope derived from the user's objective (trusted input the attacker does not control), so an injection cannot authorize what the user never asked for
- Rule of Two scanner: flags a toolset holding untrusted input + private data + a way to act, decidable from the tool definitions alone (advisory, never blocking)
- Untrusted-content marking (spotlighting): wraps tool/retrieved spans in provenance markers before forwarding. Measured 47-100% reduction in adaptive attack success across six frontier models, at no measurable utility cost; 13.6% residual on gemini-2.5-pro. Opt-in, per project
- OpenClaw agent security (indirect prompt injection defense, tool call validation, skill marketplace scanning)
- Real-time threat detection: <10 ms deterministic fast path; escalated requests are network-bound (see https://docs.promptguard.co/production/latency-budgets)
- Confidence scores returned via X-PromptGuard-Confidence header
- Content safety classification (LLM-based) and multi-turn intent drift detection
- Red team testing suite (20+ attack vectors, one-click security grading)
- GitHub Code Security Scanner (AST-based, zero false positives, auto-fix PRs)
- Per-request DoS protection (prompt size and body size limits)
- Webhook alerting (Slack, custom endpoints)
- Smart response caching and multi-provider routing with failover
- Zero retention mode (process without storing content)
- SOC 2 audit logging with integrity hash chaining
- Free tier: 20,000 requests/month

# How It Works
1. Choose an integration method: SDK auto-instrumentation (one line), HTTP proxy (swap base URL), or Guard API (direct scanning)
2. PromptGuard analyzes every request before it reaches the LLM
3. Malicious prompts are blocked, PII is redacted, confidence scores are returned
4. Clean requests are forwarded to OpenAI/Anthropic/Google/Cohere/Bedrock
5. Responses are scanned for PII, API keys, and toxicity before returning
6. Detailed logs, alerts, and analytics are provided via the dashboard

# SDKs
- Python SDK: promptguard-sdk on PyPI (MIT license, open source) - https://github.com/acebot712/promptguard-python
- Node.js SDK: promptguard-sdk on npm (MIT license, open source) - https://github.com/acebot712/promptguard-node
- Both support auto-instrumentation (promptguard.init()) and direct scanning (GuardClient)

# CLI & MCP Server
- CLI: promptguard-cli on crates.io and Homebrew (Apache 2.0, Rust) - https://github.com/acebot712/promptguard-cli
- Standalone Python MCP server: `pip install promptguard-mcp-server` or `uvx promptguard-mcp-server` or `npx @promptguard/mcp-server` or `docker run abhijoysarkar/promptguard-mcp-server`
- Also available as native MCP server built into the Rust CLI: `promptguard mcp -t stdio`
- Supports stdio and Streamable HTTP transports
- Exposes 6 tools: auth, logout, scan_text, scan_project, redact, status
- Works with Cursor, Claude Desktop, Claude Code, VS Code GitHub Copilot, Windsurf, Cline, Roo Code, Continue, Zed, Goose, Gemini CLI, Lovable, Microsoft Copilot Studio, Sourcegraph Cody, LibreChat, Emacs MCP, and any MCP-compatible AI editor or agent
- Cursor plugin available at https://github.com/acebot712/promptguard-cursor

# ChatGPT App & Codex Plugin
- HTTPS MCP server at https://api.promptguard.co/mcp for ChatGPT Apps SDK
- 7 tools: promptguard_scan_text, promptguard_scan_code, promptguard_redact, promptguard_status, search, fetch
- OAuth 2.1 authentication via Auth0 (PKCE + DCR)
- Interactive widget renders scan results, PII redaction diffs, and code audit findings inside ChatGPT
- Publishing as a ChatGPT App also creates a Codex plugin automatically
- ChatGPT App docs: https://docs.promptguard.co/tools/chatgpt

# Use Cases
- Protect customer-facing AI chatbots from jailbreaking
- Prevent data leakage in AI-powered features
- Ensure compliance by redacting PII automatically
- Monitor and audit all LLM interactions
- Block prompt injection attacks before they reach your model
- Secure AI agents with tool call validation
- Secure OpenClaw agents from indirect prompt injection and tool hijacking
- Detect unprotected LLM calls in your codebase via GitHub integration

# Target Audience
Developers and engineering teams building LLM-powered applications who need enterprise-grade security without rewriting their code.

# Pricing
- Free: $0/month, 20,000 requests, prompt injection + PII detection (ML-enhanced); the full detector set starts on Pro
- Pro: $99/month, 100K requests, full detector set (exfiltration, toxicity, fraud, secrets, malware, URL filtering), custom policies + email alerts
- Scale: $199/month, 500,000 requests included, then metered overage at $0.40 per 1,000 up to a spend cap (default $500); past the cap requests return 429. Advanced analytics.
- Enterprise: Custom pricing, SSO, audit logs, IP allowlisting, custom retention
- All plans support Ollama and vLLM for self-hosted/local model deployments

# Integration Examples

## SDK Auto-Instrumentation (Recommended)
```python
import promptguard
promptguard.init(api_key="pg_...")

# All OpenAI/Anthropic/Google/Cohere/Bedrock calls are now protected
from openai import OpenAI
client = OpenAI()
```

## HTTP Proxy
```python
from openai import OpenAI

client = OpenAI(
    base_url="https://api.promptguard.co/api/v1",
    default_headers={"X-API-Key": "pg_..."}
)
```

## Guard API
```python
import promptguard

guard = promptguard.GuardClient(api_key="pg_...")
result = guard.scan(user_input)
if result.action == "block":
    raise Exception(result.reason)
```

# Blog & Research
PromptGuard publishes security research, engineering deep-dives, and practical guides at https://promptguard.co/blog. Topics include supply chain attack analysis, prompt injection prevention, AI agent security, PII detection, compliance (HIPAA, PCI-DSS), and integration tutorials.

# Security & Compliance Posture
# Stated explicitly because an AI summarising this vendor should not have to infer it.
- SOC 2 Type II: not yet certified, on the roadmap. No audit has been completed.
- ISO 27001: planned for 2026. EU AI Act and ISO/IEC 42001: technical controls aligned, not certified.
- HIPAA: not offered; we do not sign BAAs. PHI-adjacent workloads should run self-hosted or air-gapped.
- FedRAMP: no authorization.
- GDPR/CCPA: supported. Data export and deletion endpoints; DPA available on request.
- Offered in place of an attestation: source access under NDA, build provenance on published packages, Ed25519-signed offline licences, and a reproducible egress audit for Air-gapped deployments. No formal SBOM is generated in CI yet.
- Prompt data is never used to train, fine-tune or evaluate models, and is never pooled into a shared dataset.
- Default storage is a truncated 500-character preview plus a content hash, never the full prompt. Per-project zero-retention mode stores no content at all.
- Deployment modes: Cloud; Hybrid (engine on the customer's servers, forwarding masked previews to our dashboard, or metadata only if configured); and Air-gapped (engine and dashboard on the customer's servers, offline licence verification, default-deny egress NetworkPolicy). "Self-hosted" means Hybrid or Air-gapped.
- Hosted service runs in Google Cloud us-central1. There is no hosted EU region; data residency is achieved by self-hosting.
- Access control: SAML/OIDC SSO, SCIM directory sync, four-role RBAC, and audit logging mapped to SOC 2 CC6.1/CC7.2/CC8.1.
- Uptime target 99.9%. This is a target, not a contractual SLA; no signed SLA is offered and there is no public status page.
- Vulnerability disclosure: security@promptguard.co, 48-hour acknowledgement. See https://promptguard.co/.well-known/security.txt

# Links
- Website: https://promptguard.co
- Documentation: https://docs.promptguard.co
- Whitepaper: https://promptguard.co/whitepaper
- Blog: https://promptguard.co/blog
- CLI: https://github.com/acebot712/promptguard-cli
- Cursor Plugin: https://github.com/acebot712/promptguard-cursor
- ChatGPT App Docs: https://docs.promptguard.co/tools/chatgpt
- MCP Docs: https://docs.promptguard.co/tools/mcp
- Security & Trust: https://promptguard.co/security
- Subprocessors: https://promptguard.co/subprocessors
- Data Processing Agreement: https://promptguard.co/dpa
- Contact: support@promptguard.co
- Security contact: security@promptguard.co