Rampart vs RiskKernel

Rampart and RiskKernel are both guardrails & safety tracked by AIDiveForge. Below is a side-by-side comparison of pricing, capabilities, platforms, and ownership — sourced from each tool's live website and verified before publishing.

Rampart

Rampart runs a two-layer pipeline entirely in the browser: a 14.7 MB ONNX token-classification model from Hugging Face combined with a deterministic recognizer layer that catches what the model misses. Nothing leaves the client unredacted — the architecture makes server-side PII exposure structurally impossible, not just policy-dependent. The npm package ships as a complete, reproducible artifact, so your redaction behavior is auditable and consistent across builds. The ceiling arrives when your entity types fall outside what the bundled model was trained to recognize — at that point you are retraining or replacing the model, not tweaking a config. Teams needing real-time redaction across high-volume server-side pipelines will hit the browser-only constraint immediately.

RiskKernel

Deployed as a single Go binary, it sits in front of your existing OpenAI, Anthropic, or LangChain stack via a one-variable proxy — no rewrite required. Every call is metered and checkpointed, so a killed or crashed run resumes from the last saved state instead of re-spending from zero. The human-approval gate routes irreversible tool calls for sign-off over CLI, web, or webhook before they fire, and the LLM cannot bypass it because the gate lives in compiled code, not a prompt. The hosted dashboard is private beta only; teams that need a UI today are self-managing.

Attribute	Rampart	RiskKernel
Pricing	Free	Free
Free trial	No	No
Open source	Yes	Yes
Has API	No	Yes
Self-hosted option	Yes	Yes
Platforms	Browser, Node.js	Linux, macOS, Windows (Go binary)
Pros	Client-side ONNX inference means PII never leaves the browser unredacted, so a misconfigured server filter or a mid-request failure cannot expose raw user text to your LLM provider. Defense-in-depth pipeline — model layer plus deterministic recognizer — so structured entities like emails and phone numbers are caught even when the token classifier is uncertain, reducing the false-negative surface area compared to single-pass approaches. Ships as a versioned npm package with an eval suite and bundled model weights, so redaction behavior is reproducible across builds and auditable by commit — which matters when a compliance reviewer asks what changed between releases. Open-source with MIT or equivalent license (per the repository), so your legal team can read the full implementation rather than trusting a vendor's privacy attestation on a black-box API. Hugging Face model loading with an in-repository fallback, so air-gapped or reproducibility-sensitive deployments do not depend on an external CDN staying up.	Hard per-run dollar and token ceilings enforced in compiled code, which means the kill switch fires before the overspend registers rather than after the invoice cycle closes. Crash-resumable checkpointing, so a process killed mid-run restarts from the last saved state instead of replaying every prior API call and paying for them again. Human-approval gate for side-effecting tool calls that the LLM cannot route around, so irreversible actions — deleting records, sending messages, writing to external systems — wait for a human decision before executing. One-variable proxy adoption with no code rewrite required, so existing agents running against OpenAI or Anthropic get metering and enforcement without refactoring the application. Self-hosted Apache 2.0 binary with BYO provider keys and no telemetry, so teams in regulated or air-gapped environments get full auditability without exporting run data to a third-party service.
Cons	The pipeline is architected for browser execution — teams running redaction server-side in Node.js, Python, or a backend compliance layer have no supported path and need a different tool entirely. The bundled model covers the entity types it was trained on; when your domain introduces entity patterns outside that distribution — internal employee IDs, proprietary product codes, jurisdiction-specific ID formats — the model does not adapt without retraining, and the deterministic layer only catches patterns explicitly coded into it. At 14.7 MB, the ONNX model adds a non-trivial initial load cost in browser contexts; applications targeting low-bandwidth users or requiring sub-second first-interaction readiness need to measure this against their performance budget before committing. No API, no hosted option, and no server-side SDK means teams that want managed PII redaction with SLA guarantees or audit logging infrastructure will switch to a commercial data-loss-prevention service — Rampart's local-first design is exactly what those teams cannot use.	The hosted dashboard is private beta only, so teams that need a web UI to monitor, review, or manage runs across agents have no production-ready option yet — they operate through CLI or build their own view against the OpenTelemetry export. SDK adapters are scoped to LangChain, the Claude Agent SDK, and the OpenAI Agents SDK; teams running CrewAI, AutoGen, or any other framework hit the proxy layer only and lose loop-count and tool-level controls until they write their own adapter. The project is maintained by a single developer with no enterprise support tier listed; teams whose compliance posture requires a support contract or SLA will find nothing on offer and will move to a vendor-backed observability or guardrails product instead.

Bottom line

Only RiskKernel exposes a public API. Choose based on which difference matters most for your workflow.

Frequently asked questions

What is the difference between Rampart and RiskKernel?

Rampart is Free and open source, while RiskKernel is Free and open source. Compare pricing, free trial, API, platforms, and pros/cons in the table above on AIDiveForge.

Is Rampart better than RiskKernel?

It depends on your workflow. Use the side-by-side attributes (pricing, open source, API, self-hosted, platforms) to decide. AIDiveForge does not rank a universal winner — we publish verified facts so you can choose.