Guardrails & Safety With an API
As of September 2026, AIDiveForge tracks 23 guardrails & safety with an api. The top three by verified-data score are Fabraix Red Team Playground, Proofly, and Cortega AI Governance Platform. Curated guardrails & safety with an api tracked by AIDiveForge. Listings are verified against each tool's live website and re-checked regularly.
Last updated September 9, 2026 · 23 tools
Ranked by AIDiveForge's verified-data score: data completeness, verification recency, community rating, and real visitor engagement. How we rank · No tool can pay for placement.
1. Fabraix Red Team Playground
Fabraix Red Team Playground is an open-source, MIT-licensed testing environment structured around CTF-style challenges that let you probe published agent prompts for prompt injection vulnerabilities and guardrail failures. The workflow is concrete: challenges present a live agent prompt, you craft adversarial inputs, and the platform scores whether your attack broke containment. Self-hosting via npm means your proprietary prompts never leave your environment, which matters when the thing you are testing is a production system prompt you cannot share publicly. The challenge library is community-contributed and public, so coverage depends entirely on what the research community has submitted — niche agent architectures with specialized guardrail logic will find thin coverage fast.
FreeOpen SourceAPISelf-hostedVerified Aug 14, 2026
2. Proofly
Proofly is a face-swap detection API that returns a verdict on whether an image or video has been manipulated, with no minimum spend required. The vendor states a 99.2% precision rate, which sits above every named competitor in their published comparison table. Free checks are available for face-swap verification, which lets teams validate detection quality against their own media before committing to per-request costs. The API design means integration into a content moderation pipeline is a code problem, not a contract negotiation. Where the tool shows its limits is scope: it is built specifically for face-swap detection, so teams needing broader manipulation signals — audio cloning, GAN artifacts outside of faces, metadata forensics — will need to bolt on additional tooling.
Paid$0.05 per requestAPIVerified Sep 9, 2026
3. Cortega AI Governance Platform
Cortega deploys as a gateway layer on infrastructure you control, intercepting every LLM call — from browsers, agents, servers, and cloud runners — and running identity verification, data inspection, and policy enforcement before the request egresses. The control plane manages policy, identity, routing, and budget caps across every gateway; the analytics plane turns that governed traffic into an org-wide picture of who is calling what model, at what cost, with what data categories. Where it earns its place is regulated environments: audit trails record identity, data category, policy decision, approval, model, provider, and outcome — the evidence reviewers actually ask for, not a raw log dump. The ceiling appears when your governance requirements demand deep application-layer logic that lives outside the gateway path, or when your teams are still in early AI experimentation and the architecture review overhead exceeds the compliance exposure you are trying to close.
PaidAPISelf-hostedVerified Aug 16, 2026
4. NeuralTrust TrustGate
NeuralTrust TrustGate sits between your agents and the models, tools, and services they reach, enforcing policy at the interaction level rather than bolting controls on after the fact. The vendor states the gateway handles real-time enforcement at sub-100ms latency and claims behavioral, contextual, and multilingual detection across 22 million-plus AI interactions analyzed. Self-hosted deployment via on-prem or VPC keeps data inside your perimeter — a hard requirement in regulated industries where data leaving the environment ends the conversation. The open-source core is Apache-2.0 licensed, which means your security team can audit what is actually running. Enterprise features, SIEM integration, and dedicated support are paid-only.
PaidOpen SourceAPISelf-hostedVerified Aug 14, 2026
5. OpenTrust
OpenTrust runs in the browser, gathers signals about the environment and interaction patterns, and returns a trust score your server can act on. It fits teams that want a first-pass human-presence check layered on top of existing auth — not a replacement for it. The SDK is open-source and self-hostable, so the signal pipeline stays off third-party servers. The ceiling appears when you need decisioning logic, model retraining on your own fraud data, or server-side verification depth — none of that ships in the box. Teams with those needs wire OpenTrust as one input into a broader risk engine they build and maintain separately.
FreeOpen SourceAPISelf-hostedVerified Jul 24, 2026
6. PassControl
PassControl sits between your agents and your LLM provider, giving each agent its own scoped credential while keeping the actual provider key server-side only. Before a call reaches OpenAI or any other provider, PassControl checks the agent's identity, its kill state, the model scope it's allowed, and whether its budget is still available — then returns a signed receipt so you have a verifiable record. Suspend one agent and the rest of the fleet keeps running. The product is in private beta for the hosted cloud path, which means production teams with strict uptime requirements should treat it as early-stage. Self-hosting via npm is available, but the vendor is explicit that the system has not yet been independently audited.
PaidAPISelf-hostedVerified Aug 16, 2026
7. Stonefold
Stonefold intercepts each action an agent tries to take, checks it against rules your team wrote and approved, routes sensitive ones to a named person for sign-off, and writes every attempt to an audit record — regardless of outcome. The vendor's own test is the clearest argument for it: a cheap model fell for a planted fraud email twelve out of twelve times, while an expensive model caught it every time, but with Stonefold's bank-detail rule in place, neither model let money reach the attacker. The checkpoint lives outside the model, so swapping models doesn't change your exposure. The project is at specification v0.4 and explicitly described as a working prototype — not a hardened production system.
FreeOpen SourceAPISelf-hostedVerified Aug 14, 2026
8. ButterClaw
ButterClaw runs as a self-hosted security monitor for AI agent deployments, watching post-authorization behavior for prompt injection attempts, credential exfiltration, and policy violations in real time. When it detects a breach condition, it can automatically revoke OAuth tokens and shred local credentials without waiting for a human to intervene. All of this runs locally — no cloud telemetry, no outbound data — which matters when the agents themselves are handling sensitive credentials. The Apache 2.0 license and Docker deployment model mean you own the stack entirely. The trade-off: without a vendor-hosted control plane, your team carries the operational weight of tuning and maintaining policies.
FreeOpen SourceAPISelf-hostedVerified Aug 14, 2026
9. Vultrino
Vultrino runs as a self-hosted credential proxy: agents reference an alias like 'github', and Vultrino injects the real token server-side, scrubs it from egress, and enforces a policy layer that decides whether the request is allowed at all. The agent never sees the key. AES-256-GCM encryption with Argon2 key derivation protects credentials at rest, so a stolen storage file doesn't yield anything readable without the master password. WASM plugins extend the model to PGP signing, SSH authentication, and crypto wallet transaction signing — credential types most proxy tools don't touch. The policy engine lets you scope each agent to specific URL patterns and HTTP methods, so a compromised agent role can't pivot beyond what it was granted.
FreeOpen SourceAPISelf-hostedVerified Aug 14, 2026
10. Stacksona
Stacksona is a runtime governance layer that intercepts agent tool calls before execution and evaluates them against rules derived from your existing policies. Safe actions pass through automatically, policy violations are rejected outright, and edge cases — the $2,400 refund that needs a manager, the data export that requires sign-off — pause the workflow at that specific action while the rest of the agent state is preserved. The integration surface is real: JavaScript SDK, an MCP server, an n8n node, and a decision API, so it attaches to the agent stack you already run rather than replacing it. The ceiling appears when your policy logic requires context the governance layer cannot resolve autonomously — at that point, human review queues grow and the throughput advantage of automation narrows.
PaidFree Trial · 14 daysAPIVerified Aug 16, 2026
11. Agent Governance Toolkit
Policy enforcement, zero-trust identity, execution sandboxing, and reliability engineering for autonomous AI agents.
FreeOpen SourceAPISelf-hostedVerified May 1, 2026
12. Agent Passport
Agent Passport is an open-source authorization layer that sits between your agents and the actions they take. You issue a scoped passport — specific permissions, a spend cap, a time window — then every action checks against it before executing. Denied calls are logged alongside allowed ones, so you have a record either way. Delegation chains shrink permissions as they pass down to sub-agents; a child passport cannot exceed what the parent granted. Revocation cascades instantly across the whole chain, so you're not hunting down API keys across six services.
FreeOpen SourceAPISelf-hostedVerified Jul 1, 2026
13. AxioRank
AxioRank sits between your agents and every surface they can reach — MCP servers, APIs, databases — and runs a verify-score-decide-record pipeline on every tool call before anything executes. Short-lived tokens default to a 15-minute lifetime, so a leaked credential expires before it causes damage. Thirty-one content detectors score each payload for credential leakage, destructive SQL, and SSRF attempts, and the policy engine resolves deny-overrides in under 100 ms on the synchronous path. The vendor states secrets are fingerprinted but never stored, and audit rows are redacted and append-only. SSO and extended audit retention are paid-only features, so teams with strict compliance requirements hit that wall fast.
Paid$49/moAPIVerified Jun 30, 2026
14. ComplyEdge
ComplyEdge is an open-source compliance engine that runs on every production request your AI agent processes, enforcing EU AI Act Article 5 prohibitions and emitting structured audit trails instead of opaque scores. The decorator-based Python SDK wraps agent entry points with a single annotation, so enforcement is tied to the code path rather than bolted on downstream. TrustLint, the companion CLI tool, moves the same rule set into CI/CD so violations surface before deployment. The ceiling appears when you need jurisdictions beyond EU or rule sets beyond Article 5 — the repo shows EU coverage, and teams with broader regulatory scope will find themselves extending the rule library themselves. With three GitHub stars and zero open issues at time of writing, production battle-testing is still accumulating.
PaidOpen SourceAPISelf-hostedVerified Jun 18, 2026
15. Declaw
Each agent execution runs inside a hardware-isolated microVM with a warm-pool restore measured in milliseconds. Outbound traffic passes through a per-sandbox proxy the agent cannot bypass, enforced at both L3/L4 and L7 — so if your allowlist says api.openai.com only, evil.com gets blocked and logged automatically. The credential vault injects secrets at the proxy layer, meaning API keys never enter the VM itself. Where Declaw shows its limits: there is no self-hosted option, so teams in air-gapped environments or with data-residency requirements that preclude third-party cloud infrastructure hit a hard wall. Those teams look at building their own Firecracker wrapper.
PaidAPIVerified Jul 3, 2026
16. Dike
Route your OpenAI-compatible traffic through Dike and every prompt, retrieval step, and completion becomes a sealed, cryptographically verifiable audit record — the kind an auditor can check, not just a log you printed yourself. PII is stripped before anything touches storage, flagged responses queue for human sign-off, and when a serious incident fires, Dike opens the Article 73 case and starts the 15-day reporting clock automatically. The gateway is fail-open, so if audit storage goes unreachable, your requests still reach the model. The ceiling appears when your compliance requirements go beyond what a passive proxy can enforce — custom risk-scoring logic, multi-jurisdiction rules, or on-premises data residency all require architecture Dike does not currently offer.
Paid€49/moAPIVerified Jul 8, 2026
17. Emilia Protocol
EMILIA sits as a control layer between an agent's decision and the system of record, blocking any irreversible write until a named human has signed off on the exact action hash from their own device. The protocol's core guarantees — no replay, no self-approval, no bypassing the gate — are machine-checked as TLA+ invariants and Alloy facts on every commit, not asserted in a policy document. Every approved or rejected action produces a Merkle-anchored evidence receipt retrievable at a standard API endpoint, so your auditor gets a signed artifact, not a log you assembled after the fact. The control layer is passive: it does not plan or execute anything itself, which means there is no agentic surface area to compromise.
PaidAPIVerified Jun 14, 2026
18. Exogram
Exogram is an execution governance layer that intercepts AI agent actions — payments, database writes, customer emails, record updates — and applies a policy decision before anything hits your infrastructure. The vendor describes a four-way enforcement decision: allow, deny, escalate, or log. Policy rules are checked at runtime, not after the fact, which means a $25,000 invoice approval blocked against a $1,000 limit never reaches your payment system. The immutable audit trail is positioned for SOC 2, HIPAA, and financial compliance workflows. The tool is not itself an agent runner — it assumes you already have an agent; it governs what that agent is allowed to touch.
PaidAPIVerified Jun 1, 2026
19. gate-oc-audit
Gate operates as a drop-in proxy: your agent points at one endpoint, Gate inspects every outbound prompt and every inbound response, then enforces the policy you write — blocking injections, redacting secrets and PII, flagging ambiguous cases, and writing every decision to a tamper-evident audit log anchored to a blockchain. The vendor reports 97.4% F1 across 16 public prompt-injection benchmarks and a head-to-head F1 of 96.6% versus Lakera Guard's 83.7% on four matched datasets; methodology and per-benchmark scores are published. Token compression and prefix caching run on every request, and the vendor states users see 20% or more token savings without changing model outputs. Gate is in private beta with no self-hosted deployment option, so teams with hard data-residency requirements hit a wall immediately.
PaidOpen SourceAPIVerified Jun 18, 2026
20. Gateplex
Gateplex is governance middleware: it does not run your agents, it watches them. The vendor describes it as a policy enforcement layer that intercepts agent actions — API calls, approvals, data sends — checks them against defined rules, and blocks or flags violations before execution completes. That distinction matters for regulated environments where post-hoc logging is not enough. The free tier covers three agents and a capped intercept volume per month, which fits a proof-of-concept but runs short the moment a second team deploys. Beyond that ceiling, teams move to a paid tier or hit a wall.
Paid$199/monthAPIVerified Jun 2, 2026
21. Northbeams
Northbeams sits between your workforce and their AI tools, classifying what's running, blocking what shouldn't be, and generating the evidence chain your SOC 2 or HIPAA auditor will ask for. The browser-based agent installs without network changes, so IT doesn't need a procurement cycle to get visibility. Discovery is ungated, which means you can map your shadow AI footprint before committing to enforcement. The ceiling appears when your environment scales past a single site or when you need MCP agent governance — those capabilities are paid-only features. Teams running large multi-site deployments report that per-seat policy management becomes the operational bottleneck.
PaidFree Trial · 14 days$9,600/yrAPIVerified Jun 5, 2026
22. RiskKernel
Deployed as a single Go binary, it sits in front of your existing OpenAI, Anthropic, or LangChain stack via a one-variable proxy — no rewrite required. Every call is metered and checkpointed, so a killed or crashed run resumes from the last saved state instead of re-spending from zero. The human-approval gate routes irreversible tool calls for sign-off over CLI, web, or webhook before they fire, and the LLM cannot bypass it because the gate lives in compiled code, not a prompt. The hosted dashboard is private beta only; teams that need a UI today are self-managing.
FreeOpen SourceAPISelf-hostedVerified Jun 12, 2026
23. Trajeckt
The tool sits as a runtime gateway between your agent and its tools, evaluating the sequence of calls rather than any individual call in isolation. The vendor states enforcement runs deterministically in approximately 1.6ms, outside the model itself, so policy decisions cannot be overridden by prompt injection. It is open-source under Apache-2.0 and self-hostable via Docker or Cargo. Where it fits well is MCP-compatible setups that need sequence-level rules without building a custom policy engine. Where it breaks is anywhere you need probabilistic or context-aware rules — this is deterministic enforcement, and the constraints you do not define ahead of time do not get caught.
FreeOpen SourceAPISelf-hostedVerified Jul 1, 2026
Listings on this page are sourced and verified by the AIDiveForge data pipeline. AIDiveForge is editorially independent — inclusion and rank are not for sale. Labeled ads are separate.