Prompt-injection firewall

Three defensive layers between untrusted text and your model — rules, semantic analyzer, sanitizer. Score any string with one API call, whatever produced it, or drop the OpenAI-compatible proxy in front of your chat completions.

THE PROBLEM

Injections don't come through the front door.

Prompt injections hide in user messages, pasted documents, scraped web pages, and tool outputs. A single regex list catches yesterday's attacks; the ones that hurt you are phrased politely, split across turns, or buried in a PDF your agent was asked to summarize.

Shield runs defense in depth: a fast rules layer for known patterns, a semantic analyzer that scores intent, and a sanitizer that neutralizes what it can instead of blocking outright. Hand it any string — a user message, a retrieved chunk, a tool result — and it returns a verdict you decide what to do with. Every detection lands in your Shield log with its confidence score and the layer that made the call, including the ones you chose to let through in flag-only mode.

Send the text you do not trust

POST it to /canaryshield/inspect with your API key. A user message, a scraped page, a tool result, a retrieved chunk — anything about to reach a model. Shield never talks to the model, so any provider works.

Three layers score it

Rules → analyzer → sanitizer. You get back whether it is blocked, the attack class, a confidence score, the layer that decided, and a sanitized version of the text to pass on.

Or let the proxy do it

For chat completions, point your OpenAI client's base_url at Shield and the same three layers run inline on the user turns of every request. Detections are logged and alerted either way.

WHAT YOU GET

Everything reports into the same console.

import httpx

r = httpx.post(
  "https://api.canaryvaults.com/canaryshield/inspect",
  headers={"X-API-Key": "cv_..."},
  json={"user_id": "<your-uuid>", "user_message": tool_result},
  follow_redirects=False)   # X-API-Key survives a cross-host redirect; do not follow one

if r.status_code == 402:
  # Plan limit: the text was NOT inspected. "not blocked" here means
  # nothing looked at it — it does not mean the text is clean.
  verdict = {"blocked": False, "inspected": False, "reason": "plan_limit"}
else:
  r.raise_for_status()
  verdict = {**r.json(), "inspected": True}

if verdict["blocked"]:
  raise RuntimeError(verdict["attack_type"])

user_id must be your own workspace UUID or the call is a 403. The verdict carries blocked, attack_type, confidence, explanation, decided_by and sanitized_message — forward the sanitized text, not your original. A 402 means the inspection never ran because your plan's Shield quota is used up, so treat it as "not inspected" rather than "clean". For chat completions there is also a proxy: set base_url to https://api.canaryvaults.com/canaryshield/v1 and keep the rest of your OpenAI client.

Which models does Shield support?

For /canaryshield/inspect, all of them — it scores text and never contacts a model, so self-hosted, streaming and Anthropic direct are all fine. The proxy is narrower: it forwards only to an allowlisted provider over https — OpenAI, Groq, OpenRouter, Together, Mistral, DeepSeek and xAI. Point X-Upstream-Base-URL at one of those and the model never knows Shield is there. vLLM, Ollama and anything on localhost are refused, and Anthropic is reachable only through a gateway such as OpenRouter.

What does Shield actually inspect?

In proxy mode, the user turns of the conversation — every message with role "user", not only the newest. Content arriving as a tool result, an assistant turn or a system prompt is forwarded unread, so if your agent pastes a scraped page into a tool message, score it explicitly with /canaryshield/inspect before it reaches the model.

What about false positives?

Start in flag-only mode. Point base_url at /canaryshield/v1/flag and nothing is turned away: the same three layers run, every detection is recorded and alerted, and the request still reaches your model with the verdict in the response headers. Measure it against your own traffic, then drop /flag to enforce.