The engine behind the hosted API is published as six Python packages. Each one does a different job, installs in a single line, has no dependency on the others, and is useful entirely on its own. Take the one you need, or take the gateway and let it wire the rest together.
Nine sequential layers: invisible-character stripping, Unicode normalisation, homoglyph folding, entropy and repetition checks, injection keywords across 21 languages, and a seven-variant decoder for encoded payloads. Put it in front of any LLM call, whatever framework you use.
Don't filter what your AI says. Filter what it is about to do. Shell bans, deletion bans, write and read whitelists, credential URLs, pipe-to-shell detection, and optional human approval for high-impact actions. Zero dependencies.
Freeze your ground-truth state, define rules against it, and check every proposed answer before you act on it. Returns the failures plus a correction string built for feeding straight back into a prompt. The retry loop stays yours. Zero dependencies.
Tool definitions are captured at startup and frozen; every call is verified against that frozen reference with a hash-chained audit log. A server that quietly changes its schema or permissions mid-session is caught rather than trusted.
A gating proxy for MCP servers. Point your client at the gateway instead of at your servers, and every call runs the whole chain (policy, behavioural floor, text inspection, frozen verification) before the server that would execute it ever sees it. The only one that needs no change to your code, and it prints which layers are active at startup so a partial install is visible rather than silent.
Unlike everything else here, this one is free and Apache 2.0. It connects to any MCP server as a client, inventories the tools, classifies each by blast radius, then fires malformed and hostile arguments at every field and reports what was accepted. Run against four published MCP servers it reported three clean and found ten accepted inputs in mcp-server-sqlite, including SQL metacharacters in a field its source interpolates straight into a query. State-changing tools are skipped unless you ask.
SovereignShield