LLM Firewall (llmfw)

A safety layer between your application and any LLM API. It inspects prompts (input) and responses (output), applies a set of default checks, and optionally applies extra domain-specific checks (finance, medical, legal, ...). Ships with a local dashboard to visualize what got flagged or blocked over time.

Install

pip install llmfw            # core
pip install llmfw[dashboard] # + local dashboard (FastAPI/uvicorn)
pip install llmfw[all]       # everything

What to do after installing

You already have a chatbot or an app that calls an LLM. There are exactly 3 things to add around your existing code — nothing else changes.

from llmfw import Firewall

fw = Firewall(domain="finance")  # 1. create once (pick your domain, or omit it)

def handle_message(user_message):
    check = fw.check_input(user_message)          # 2. check what the user sent
    if not check.allowed:
        return f"Sorry, I can't help with that ({check.blocked_by})."

    response = call_your_llm(check.redacted_text)  # your existing LLM call, unchanged

    out_check = fw.check_output(response)          # 3. check what the LLM sent back
    if not out_check.allowed:
        return "Sorry, I can't share that response."

    return out_check.redacted_text

Replace call_your_llm(...) with whatever you already use (OpenAI, Claude, Gemini, ...) — that part doesn't change. fw should be created once per user session, not once globally for your whole app (see docs/architecture.md for why).

Prefer one line instead of wrapping input/output separately?

result = fw.protect(user_message, llm_call_fn=call_your_llm)
if not result.allowed:
    return f"Blocked: {result.blocked_by}"
return result.redacted_text

See examples/quickstart.py for a runnable version, or the full docs for configuration, the CLI, and the dashboard.

What it checks

Default detectors (always run):

• Injection — prompt injection / jailbreak detection (pattern, structural, and paraphrase matching)
• PII — emails, phone numbers, SSNs, card numbers (Luhn-validated), IPs — redacted in place
• Output validator — schema/length checks, basic hallucination markers
• Leak guard — detects system-prompt-like content leaking into output
• Multi-turn tracker — flags cumulative suspicious patterns across a session
• Toxicity — hate speech / self-harm / abuse filter
• Obfuscation — decodes base64/unicode/leetspeak tricks before re-running the other checks

Domain packs (opt-in via domain=):

• finance — guaranteed-return scam phrasing, unlicensed investment advice, pump-and-dump/fake-ticker hype
• medical — unlicensed diagnosis/prescription language, unsafe dosage mentions, patient-identifiable health info (PHI)
• legal — unauthorized legal advice/guaranteed-outcome phrasing, unverified case citations flagged for human review

CLI

llmfw check "some prompt" --domain finance
llmfw dashboard              # launch the local dashboard at localhost:8420
llmfw test --domain finance  # run the curated attack-prompt suite

Dashboard

llmfw dashboard starts a local FastAPI server (requires the dashboard extra) that serves a small UI showing recent blocked/flagged events, a breakdown by rule and domain, and a blocks-per-day trend. Events are logged to a local SQLite database (llmfw_events.db by default).

Configuration

# llmfw.config.yaml
domain: finance
enabled_detectors:
  - injection
  - pii
  - output_validator
  - leak_guard
  - multiturn_tracker
  - toxicity
  - obfuscation
thresholds:
  injection: 0.6
log_events: true
db_path: llmfw_events.db

fw = Firewall(config="llmfw.config.yaml")

Testing

pip install -e ".[dev,dashboard]"
pytest tests/
python -m tests.benchmark   # false-positive / false-negative rate per domain

License

MIT