llmfw 0.1.0

A safety layer between your application and any LLM API — input/output firewalling, PII redaction, jailbreak detection, and domain-specific guardrails.

llmfw — LLM Firewall

A safety layer between your application and any LLM API. It inspects prompts (input) and responses (output), applies a set of default checks, and optionally applies extra domain-specific checks (finance, medical, legal, ...). Ships with a local dashboard to visualize what got flagged or blocked over time.

Install

pip install llmfw            # core
pip install llmfw[dashboard] # + local dashboard (FastAPI/uvicorn)
pip install llmfw[all]       # everything

Quickstart

from llmfw import Firewall

fw = Firewall(domain="finance")

result = fw.check_input(user_prompt)
if not result.allowed:
    return "Request blocked: " + result.blocked_by

response = call_llm(result.redacted_text)

out_result = fw.check_output(response)
if not out_result.allowed:
    return "Response blocked"

return out_result.redacted_text

Or wrap the whole request/response cycle in one call:

result = fw.protect(user_prompt, llm_call_fn=call_llm)

See examples/quickstart.py for a runnable version.

What it checks

Default detectors (always run):

• Injection — prompt injection / jailbreak detection (pattern, structural, and paraphrase matching)
• PII — emails, phone numbers, SSNs, card numbers (Luhn-validated), IPs — redacted in place
• Output validator — schema/length checks, basic hallucination markers
• Leak guard — detects system-prompt-like content leaking into output
• Multi-turn tracker — flags cumulative suspicious patterns across a session
• Toxicity — hate speech / self-harm / abuse filter
• Obfuscation — decodes base64/unicode/leetspeak tricks before re-running the other checks

Domain packs (opt-in via domain=):

• finance — guaranteed-return scam phrasing, unlicensed investment advice, pump-and-dump/fake-ticker hype
• medical — unlicensed diagnosis/prescription language, unsafe dosage mentions, patient-identifiable health info (PHI)
• legal — unauthorized legal advice/guaranteed-outcome phrasing, unverified case citations flagged for human review

CLI

llmfw check "some prompt" --domain finance
llmfw dashboard              # launch the local dashboard at localhost:8420
llmfw test --domain finance  # run the curated attack-prompt suite

Dashboard

llmfw dashboard starts a local FastAPI server (requires the dashboard extra) that serves a small UI showing recent blocked/flagged events, a breakdown by rule and domain, and a blocks-per-day trend. Events are logged to a local SQLite database (llmfw_events.db by default).

Configuration

# llmfw.config.yaml
domain: finance
enabled_detectors:
  - injection
  - pii
  - output_validator
  - leak_guard
  - multiturn_tracker
  - toxicity
  - obfuscation
thresholds:
  injection: 0.6
log_events: true
db_path: llmfw_events.db

fw = Firewall(config="llmfw.config.yaml")

Testing

pip install -e ".[dev,dashboard]"
pytest tests/
python -m tests.benchmark   # false-positive / false-negative rate per domain

License

MIT