🔱 Trishul Guardrail Proxy
Get your API key checking…

One guardrail layer between any agent and the LLM.

Trishul is a drop-in, OpenAI-compatible proxy. Five rails — input, dialog, retrieval, execution, output — enforce declarative safety policy across the whole agent lifecycle. Swap one base_url and every call is firewalled: prompt injection, PII, tool-policy, and egress leaks. Zero code change.

OpenAI-compatible5 declarative rails No Colang DSLStreaming egress verifier Human-in-the-loop
Get your API key See benchmarks 

    

  


  


  
  

    
Five rails, one declarative policy

    
Each rail is a guard stage in the request lifecycle. All behavior lives in a single policy.json — declarative, no Colang DSL to learn. Positioned squarely against Tumeryk / NeMo Guardrails: same coverage, none of the dialog-flow scripting.

    

      
RAIL 1
Input
Firewalls inbound prompts — weighted prompt-injection scoring plus deterministic PII/secret masking before the model ever sees the text.

      
RAIL 2
Dialog
Topic & SOP control. Block-list off-limits subjects or allow-list an approved scope. Declarative, no dialog-flow scripting.

      
RAIL 3
Retrieval
Guards RAG context. Scores every chunk for indirect injection and masks PII — the top real-world agent attack, defused pre-model.

      
RAIL 4
Execution
Risk-scores every tool call. Destructive ops and off-domain data egress route to a human-in-the-loop approval queue.

      
RAIL 5
Output
Streaming egress verifier catches leaked secrets, echoed PII and fake tool confirmations — even split across SSE chunk boundaries.

    

  


  
  

    
Try it live

    
Every tab below hits the running gateway on this domain. No mocks.

    

    
    

      

        
See Trishul in action

        
Watch Trishul firewall a live attack and walk through all five rails, agent governance, benchmarks and compliance — in 90 seconds.

      

      

        
      

      

        
What you're seeing

        
The 90-second walkthrough, chapter by chapter.

        
    
          
  1. The problem — prompt injection, PII/secret leakage, unsafe tool calls, and poisoned RAG context.
    2. 
          
  2. Drop-in OpenAI-compatible proxy — one base_url swap, zero code change.
    3. 
          
  3. The five rails — input, dialog, retrieval, execution, output.
    4. 
          
  4. Live: injection blocked — an attack stopped at the input firewall before the model ever sees it.
    5. 
          
  5. Agent governance — RBAC by role & group, with per-profile security controls.
    6. 
          
  6. Published benchmark — strong attack recall, 0% false positives, sub-millisecond latency.
    7. 
          
  7. Compliance — mapped to the OWASP LLM Top 10.
    8. 
        

      

      

        Get your API key
        Read the docs
      

    


    
    

      
      

        
Console — API keys & policies

          
Each policy has its own LLM provider + key and its own guardrail config. Requests pick a policy via the x-trishul-policy header, or use your default.

        
        

          
          
          
        

        

      


      
      

        

          
Account

            

          
        

        

        

        

      


      
      

        

          
Policies

            
Each policy carries its own LLM provider (bring-your-own-key) and a guardrail-policy override.

          
        

        

        

        

        

      

    


    
    

      

        

          
Benchmark suite
labeled adversarial dataset · deterministic path

          
        

        

        

        
Per-category accuracy

        

      

    


    
    

      

        

          
Guardrail test suites

            
Published results of every guardrail suite we run — deterministic, reproducible, honestly scored.

          
        

        

        

      

      

      

      

    


    
    

      

        
        
        
        
        
      


      
      

        

          
Input rail — ingress firewall

          
Detect prompt injection & mask PII/secrets before the prompt reaches the model.

          
Try:
            
            
            
          

          
          
          

          

        

        

          
How it decides

          
Two-layer detection, one declarative policy.

          

            1 · Deterministic — regex+checksum PII (Luhn card, Verhoeff Aadhaar), 15+ secret types, weighted injection signals.

            2 · LLM-judge — only ambiguous injection scores escalate to the model, so per-call cost stays rare.

            3 · Policy — thresholds, mask modes & block severities live in policy.json.

            4 · Large context — a sliding window scores injection buried deep in long inputs.
          

        

      


      
      

        

          
Dialog rail — topic / SOP control

          
Block-list off-limits topics, or allow-list an approved scope. No Colang.

          
Try:
            
            
          

          
          
          
          
          
          
          

          

        

        

          
Why declarative wins

          
Tumeryk & NeMo model dialog rails as Colang flow scripts you write and maintain. Trishul's dialog rail is a policy field: pick a mode, list topics. Same guarantee — refuse off-domain or on-blocklist turns — with nothing to compile.

          

            // blocklist: refuse if turn hits a listed topic

            // allowlist: refuse unless turn is on an approved topic

            Built-in lexicon: politics · medical · legal · self-harm · weapons · finance · billing · account · support
          

        

      


      
      

        

          
Retrieval rail — RAG chunk guard

          
One chunk per line. Each is scored for indirect injection; PII inside is masked; poisoned chunks are rejected before they reach context.

          
Try:
            
          

          
          
          

          

        

        

          
Indirect prompt injection

          
The #1 real-world agent attack: a poisoned document retrieved into context that hijacks the model. Per-chunk verdicts let you keep the clean context and drop only the weaponized chunk — the summary shows what was rejected, masked, and passed.

          
Summary appears here after guarding.

        

      


      
      

        

          
Execution rail — tool policy + HITL

          
Risk-scored tool calls. Destructive ops & off-domain data egress route to the human queue (see the HITL tab).

          
Try:
            
            
            
          

          
          
          
          
          

          

        

        

          
Boundary checks

          
Beyond a per-tool risk level, hard boundaries fire regardless of level:

          

            1 · Destructive critical ops always require approval.

            2 · External egress — any URL/email off approved domains carrying PII is denied outright.

            3 · Outbound send tools (send_*, email_*, post_*) escalate to at least HITL.

            Approved verdicts pass straight through; anything ambiguous parks in the queue.
          

        

      


      
      

        

          
Output rail — egress verifier

          
Scan model output for leaked secrets, echoed PII, SQL dumps, fake tool confirmations & system-prompt leaks.

          
Try:
            
            
          

          
          
          

            
            
          

          

        

        

          
Full round-trip through the proxy

          
The Full proxy round-trip button POSTs the input textarea through /v1/chat/completions with the public demo key — ingress → model → egress — and shows the returned message plus the trishul telemetry that rides along with every completion.

          
Proxy output appears here.

        

      

    


    
    

      

        

          
Human approval queue 

            
Tool calls parked for a decision. Evaluate a risky tool call in the Execution rail to add one.

          
        

        
Loading…

      

    


    
    

      

        

          
Observability
Live telemetry — refreshes every 10s while this tab is open.

          block rate —
        

        
Latency by stage (ms)

        
Stagep50p95p99samples

        
Counters

        

      

    


    
    

      
      

        
Your guardrail policy

          
Author a per-tenant policy across all five rails and save it to your key.
            Custom policies are a Pro feature.

        
        

          
          
          
        

        

      


      

        
        


          
          

            
RAIL 1

            
Input — injection & PII

            
            
            
            
0.70

            
            
            
            

            
            
          


          
          

            
RAIL 2

            
Dialog — topic / SOP control

            
            
            
            
            
            
            
            
          


          
          

            
RAIL 3

            
Retrieval — RAG chunk guard

            
            
            
0.50

            
          


          
          

            
RAIL 4

            
Execution — tool policy

            
            

              

                

              

                

              

                

              

                

            

            
            
            
            
          


          
          

            
RAIL 5

            
Output — egress verifier

            
            

            
            
          


          
          

            
CIRCUIT BREAKER

            
Failure protection

            
            
            
            
0.50

          

        


        
        

          

            

              
Policy override — live JSON

              
            

            
Sent to the server, which deep-merges it over the default policy.

            
{}

            

              
              
            

            

              
              
            

            

            
Once saved, your policy applies automatically to every /v1/… call made with your key — no code change. Try it in the Playground.

          

        

      

    


    
    

      

        
        
        
Loading profiles…

      

      

        
        
      


      
      

        

          
Tool-action governance

          
Propose an agent tool call and see the declarative policy engine allow, block, or audit it — RBAC, sandboxing, egress allow-lists, protected records and escalation, all from one rule pack.

          
Try:
            
            
            
            
            
            
            
          

          
RBAC groups:
            
            
            
            
            
          

          
          
          
          
          
Identity resolved from directory — role & groups below are ignored.

          
          
          
          
          
          
          

          

        

        

          
One rule pack, seven boundaries

          
Every tool call is turned into a context of match-able fields (role, argument size, host, path, record id, escalation token) and run top-down through priority-ordered rules.

          

            block — a terminal deny; the action is refused.

            audit — allowed, but recorded to the governance trail.

            allow — the pack default when no rule fires.

            Highest-priority terminal match wins; all matching audit rules are logged alongside.
          

        

      


      
      

        

          
Message governance

          
Governs natural-language turns before an agent acts on them — prompt-injection signatures, bulk-exfiltration phrasing, and audit-logging of registered agents.

          
Try:
            
            
            
          

          
          
          
          
          

          

        

        

          
Why govern the message too

          
The message phase catches intent before any tool call exists — an injected instruction to exfiltrate secrets is blocked on sight, while a registered agent's benign turn is allowed and audited so you keep a full decision trail.

          

            Same engine, same operators — only the field set differs: message agent stream.
          

        

      


      
      

        

          
Active policy pack 

            
The declarative rules evaluated above — live from /api/governance/policies.

          
        

        
Loading…

        
These rules are fully declarative and editable — no code, no DSL. Edit governance/policies.json to change enforcement.

      


      
      

        

          
Identity directory

            
Define users & groups once; reference them by identity. (Demo tenant — read/add here.)

          
        

        

        
Loading…

        

          
Add user

          

            

            

            

            

          

          

        

      

    


    
    

      

        

          
AI-security & governance framework coverage

            
How each Trishul rail maps to the recognized AI security & governance frameworks. Live from /api/frameworks.

          
        

        

      


      

        
Coverage summary

        
OWASP Top 10 for LLM Applications (2025), by how directly Trishul enforces each risk.

        

      


      

        
OWASP Top 10 for LLM Applications 

        
Per-risk coverage, the rails that enforce it, and how.

        
Loading…

      


      

        

          
MITRE ATLAS

          
Adversarial-ML techniques with a live runtime detection.

          
Loading…

        

        

          
Governance & regulatory

          
Posture, not runtime enforcement — Trishul supports these controls.

          
Loading…

        

      


      
Full write-up: /docs/COMPLIANCE.md · machine-readable: /api/frameworks

    

  


  
  

    
Get your API key

    
Your key is the Bearer token you drop into any OpenAI SDK. Manage keys, policies and LLM providers in the Console tab.

    

      

        
Create a key

        
We issue a live key instantly — no card.

        
        
        
        
        

        

      

      

        
Check an existing key

        
Paste a key to view its policies and monthly usage.