AI guardrails
A guardrail checks what goes into your model and what comes out: prompt injection and jailbreaks, PII, harmful content, answers that wander off topic. There are three kinds. Hosted APIs from Lakera (now Check Point), Google, AWS, Microsoft and OpenAI bill per request, token or block of text, and most have a free tier. Guardrails AI and NeMo Guardrails are open-source frameworks that run the checks in your own code. Llama Guard and Prompt Guard are open-weight models you host. Injection detection and content moderation are different jobs, and not every tool does both. Throw your own attack prompts and real traffic at two of them before you pick. 8 tools, in the order they appear in the directory. This is not a ranking.
Grouped by job: AI Agent Infrastructure
Lakera Guard (Check Point AI Guardrails)
Runtime guardrails API from Lakera, now part of Check Point and sold as Check Point AI Guardrails: one call to the Guard API screens prompts, documents and model output for prompt injection and jailbreaks, PII and data leakage, harmful content and unknown links, with tool allow and deny lists for agents. Free Community plan for 10,000 requests a month; Enterprise adds self-hosting.
Guardrails AI
Open-source (Apache-2.0) Python framework for LLM guardrails: wrap model calls in Guards that run validators on input and output, from PII and toxicity checks to your own rules, and get structured data back. Validators come from Guardrails Hub as pip packages, and it runs in your code or as a REST server with guardrails start.
NVIDIA NeMo Guardrails
NVIDIA's open-source (Apache-2.0) toolkit for programmable guardrails on LLM apps: input, output, dialog and retrieval rails that keep a bot on topic, detect jailbreaks and prompt injection, fact-check and moderate output. Configured in YAML and Colang, Python 3.10 to 3.13, works with LangChain.
Llama Guard 4 and Prompt Guard 2
Meta's open-weight guardrail models. Llama Guard 4 is a 12B multimodal classifier that labels prompts and responses, text and images, against 14 MLCommons hazard categories in 12 languages. Prompt Guard 2 comes in 86M and 22M sizes and flags prompt injection and jailbreaks. Free under the Llama 4 Community License; you host them.
Google Cloud Model Armor
Google Cloud's guardrail service for LLM apps on any cloud: screens prompts and responses for prompt injection and jailbreaks, sensitive data through Sensitive Data Protection, and hate, harassment, sexual and dangerous content, including text inside PDFs and images, with templates to set thresholds. 2 million tokens a month free, then $0.10 per million tokens.
Amazon Bedrock Guardrails
AWS's guardrails for generative AI: content filters with prompt attack detection, denied topics, word filters, PII filters and redaction, contextual grounding checks and Automated Reasoning checks. The ApplyGuardrail API checks any text without calling a Bedrock model. Content filters cost $0.15 per 1,000 text units of up to 1,000 characters; word filters and regex PII are free.
Azure AI Content Safety
Microsoft's guardrail APIs in Foundry: Prompt Shields catch user prompt attacks and instructions hidden in documents, next to text and image moderation, protected material and groundedness detection. 5,000 free text records a month, then $0.375 per 1,000 records of up to 1,000 characters in East US, with containers for disconnected use.
OpenAI Moderation API
OpenAI's free moderation endpoint, a common first guardrail: omni-moderation-latest classifies text and images across 13 categories such as harassment, hate, illicit, self-harm, sexual and violence. It can also run inline on Responses API calls, tool-call arguments and outputs included. It moderates content; it does not detect prompt injection.
What it is, what it catches, what it costs, where it runs.
Straight from each vendor's own pages. Plans move often, so the check date is below.
| Tool | What it is | Catches | Price | Deploy and license |
|---|---|---|---|---|
| Lakera Guard (Check Point AI Guardrails) | Hosted Guard API from Lakera, now sold by Check Point as AI Guardrails. | Direct and indirect prompt attacks, PII and data leakage, content violations, unknown links, agent tool calls outside an allow list. | Community $0: 10,000 requests a month, prompts up to 8,000 tokens. Enterprise quoted. | SaaS with EU data residency. Self-hosted on Enterprise. Closed source. |
| Guardrails AI | Python framework: Guards run validators on LLM input and output. | Whatever your validators check: PII, toxicity, competitors, formats, your own rules. Also returns structured data. | Free. Validators that call a model cost what that model costs. | Apache-2.0. Runs in your process, or as a Flask REST server you host. |
| NVIDIA NeMo Guardrails | NVIDIA's toolkit for programmable rails around an LLM app. | Jailbreaks and prompt injection, off-topic requests, dialog flow, fact-checking, output moderation. | Free. You pay for the models the rails call. | Apache-2.0. Python 3.10 to 3.13, self-hosted. |
| Llama Guard 4 and Prompt Guard 2 | Meta's open-weight safety classifiers. | Llama Guard 4: 14 MLCommons hazard categories in prompts and responses, text and images. Prompt Guard 2: prompt injection and jailbreaks. | Free weights. You pay for the GPU. | Llama 4 Community License, gated on Hugging Face. Llama Guard 4 is 12B; Prompt Guard 2 is 86M or 22M. |
| Google Cloud Model Armor | Google Cloud service that screens prompts and responses, for apps on any cloud. | Prompt injection and jailbreaks, sensitive data, hate, harassment, sexual and dangerous content, text in PDFs and images. | 2 million tokens a month free, then $0.10 per million tokens. Included in Security Command Center Premium and Enterprise. | Google Cloud API. Closed source. |
| Amazon Bedrock Guardrails | Configurable guardrails on Amazon Bedrock, also callable alone through ApplyGuardrail. | Prompt attacks, harmful content, denied topics, words, PII, ungrounded answers, Automated Reasoning checks. | Per 1,000 text units of up to 1,000 characters: content filters $0.15, denied topics $0.15, PII $0.10, grounding $0.10. Word filters and regex PII free. | AWS API. Closed source. |
| Azure AI Content Safety | Microsoft's content safety APIs in Foundry, Prompt Shields included. | User prompt attacks and instructions hidden in documents, harmful text and images, protected material, ungrounded answers. | Free: 5,000 text records and 5,000 images a month. Then $0.375 per 1,000 text records of up to 1,000 characters, $0.75 per 1,000 images. East US. | Azure API, plus containers for disconnected use. Closed source. |
| OpenAI Moderation API | OpenAI's moderation endpoint, omni-moderation-latest. | 13 categories of harmful text and images: harassment, hate, illicit, self-harm, sexual, violence. Not prompt injection. | Free. | OpenAI API only. Closed source. |
Checked 2026-11-02. Sources: Lakera pricing, Check Point AI Guardrails docs, Guardrails AI on GitHub, Guardrails AI docs, NeMo Guardrails on GitHub, NeMo Guardrails docs, Llama Protections, Llama Guard 4 model card, Prompt Guard 2 model card, Model Armor overview, Model Armor pricing, Amazon Bedrock pricing, ApplyGuardrail API docs, Azure AI Content Safety pricing, Azure retail prices API, Prompt Shields docs, OpenAI moderation guide.
Pick it if.
- Lakera Guard (Check Point AI Guardrails)You want one hosted call that covers injection, PII and links, free up to 10,000 requests a month.
- Guardrails AIYou write Python and want checks you can read, swap and extend, with structured output on the same Guard.
- NVIDIA NeMo GuardrailsYou need a bot that stays on script: topics, dialog flows and fact-checks, not just a filter.
- Llama Guard 4 and Prompt Guard 2Prompts can't leave your servers, or you'd rather pay for a GPU than per request.
- Google Cloud Model ArmorYou're on Google Cloud, or want 2 million free tokens a month and one cheap rate after that.
- Amazon Bedrock GuardrailsYou're on AWS and want topics, PII and grounding checks on your AWS bill, Bedrock model or not.
- Azure AI Content SafetyYou're on Azure or Foundry and want Prompt Shields to catch attacks hidden in documents and emails.
- OpenAI Moderation APIYou want a free harm filter today and will add injection detection separately.
Each listing.
The directory page, alternatives in the same category, and a head-to-head where we have one.
- Lakera Guard (Check Point AI Guardrails)Alternatives
- Guardrails AIAlternatives
- NVIDIA NeMo GuardrailsAlternatives
- Llama Guard 4 and Prompt Guard 2Alternatives
- Google Cloud Model ArmorAlternatives
- Amazon Bedrock GuardrailsAlternatives
- Azure AI Content SafetyAlternatives
- OpenAI Moderation APIAlternatives
Category pages list every tool in that category, including ones left off this page. Built one of these? Get it featured in its category.
The 2 biggest AI stories, every morning.
One short email: the two stories that matter, and why.
You're in.
The Daily AI Brief will land in your inbox soon. If you don't see it, check Promotions or Spam and move it to your main inbox.