Injection firewall
A regex fast path sheds high-volume attacks at zero ML cost; an embedding-based semantic classifier judges the subtle ones. Three operating modes tune recall against false positives.
AI agent security · Dual-layer control plane
Your agent holds a wallet.
Your agent holds a wallet.
One bad prompt shouldn't empty it.
Millisecond prompt-injection firewalls off-chain. Verifiable identity and tamper-evident evidence on-chain.
99.0% AdvBench strict|41.88 ms p95 under attack|10/10 OWASP LLM
guardian://gate/live-demo
awaiting input
Architecture note: This sandbox demonstrates the fast-path screening and client-side de-obfuscation layers (Layer 1 & 2 of 4). The full 4-layer production pipeline — including semantic embedding classification, output DLP/redaction, and on-chain Merkle anchoring — runs server-side.
Prompt injection
Base64 payload
Braille steganography
Morse encoding
ROT13 wrapper
Homoglyph swap
Hex payload
Approval phishing
System-prompt leak
PII egress
XSS in response
99.0%
AdvBench block rate · strict
benchmark run · aug 2026
41.88 ms
p95 latency while blocking
chaos report · aug 2026
40+
real-time security controls
in one gateway pass
10/10
OWASP LLM Top 10 (2025)
risks covered · test snapshot
DISCLOSURE: Compliance and audit artifacts are internally verified empirical test suites (3,211 prompts across 8 corpora), not third-party statutory certifications.
Threat model
Four layers between your agent and a bad day.
Each layer is independently tested and artifact-documented. Together they close the attack classes that ship in the wild today.
De-obfuscation engine
Morse, Braille steganography, Base64, hex, binary, ROT13, homoglyphs — normalized before classification so payloads can't hide behind an encoding layer.
Output guardrails
Responses scanned before egress: PII redacted, XSS/SQL/shell fragments blocked, system-prompt leakage caught, optional watermarking applied downstream.
Fail-closed operations
Rate limiting that closes instead of opens under failure, chaos-tested degradation, and SLO checks that run in CI — when parts die, the gateway fails safe.
One control plane
Security off-chain. Trust on-chain.
The execution layer decides in milliseconds whether traffic is safe. The trust layer makes an agent's identity and track record independently verifiable.
off-chain // execution security
- Fast-path screen — heuristics shed obvious attacks before any model inference
- Semantic firewall — embedding classifier, strict / balanced / permissive modes
- De-obfuscation pass — encodings decoded and normalized before judgment
- Response guardrails — redaction, payload blocking, watermarking
- Metering & limits — per-tenant tiers enforced fail-closed
For AI & Platform Engineers:
Sub-millisecond gateway proxy sits seamlessly in front of OpenAI, Anthropic, Ollama, or vLLM — zero changes to your agent reasoning code.
on-chain // trust suite
- ERC-8004 identity & Identity Gate — portable agent registry and pre-flight point-of-interaction enforcement with hot-wallet collision guards
- Soulbound passport — ERC-5192 reputation score (0–10000) derived from verified scan history
- Evidence anchoring — Merkle roots over security-event logs (simulated default; Monad testnet opt-in)
- Insurance certificates — cryptographic evidence packages for underwriters and compliance audits
- Interlock registry — explicit agent-to-agent authorization rules (no silent handshakes)
Plain English for Security Teams:
Every action your agent takes is logged, hashed, and provable after the fact — so when something goes wrong, you're not debugging from vibes.
Evidence
Numbers with receipts. Including the ugly ones.
Every figure on this site cites its dated repository artifact — and the proof page publishes full benchmark tables, not just highlights.
Benchmarks →
3,211 prompts across 8 public datasets, August 2026. AdvBench 99.0% strict, JBB PAIR+GCG 98.7% — and Do-Not-Answer's 57.1% published too, because selective reporting is how trust dies.
Audit status →
External pentest completed March 2026 (Independent Security Review, zero open critical/high findings). Internal off-chain and contract audits remediated July–August 2026. Next third-party external review scheduled for Q3 2026.
Chains & identity →
Nine-contract suite deployed on Base Sepolia and Monad Testnet. State anchoring runs simulated-by-default. Zero mainnet claims — verifiable directly on block explorers.
Pricing & Open Source
Hosted tiers are coming.
Hosted tiers are coming.
The engine is free and open source now.
The core engine, SDKs, and local auth proxy are 100% free under MIT. Self-host today in your VPC, or join the waitlist for our managed cloud platform.
Managed Cloud Platform
Zero infrastructure on your side. Hosted low-latency firewalls, semantic classifier clusters, automated Merkle anchoring, and compliance reporting.
Self-Hosted Engine & Design Partners
The entire detection suite is free to deploy inside your perimeter today. Point your Ollama, vLLM, or OpenAI endpoints at the universal auth proxy.
Get started
Don't wait for an exploit to audit your agents.