Guard. Runtime protection inside your application.
Guard runs inside your application, as middleware and hooks at the library and framework level. It checks incoming requests, database queries, shell commands, file paths, outbound calls, LLM client calls and MCP tool calls against the guardrails you write in Safeguard. Each guardrail starts in Monitor mode, so you see what it would block before it blocks anything.
What Guard does.
One line of middleware
Add Guard to Express, FastAPI, Django, Spring Boot, ASP.NET or Go with one middleware line, or start a Node, Python or Java app with Guard's runner and no code change. Packages install only from registry.safeguard.sh.
AvailableChecks where the risk is
Hooks in the libraries your code already uses check SQL queries as they run, shell commands, file paths, outbound calls and deserialization, so an attack is judged by what it would actually do in your code.
AvailableLLM and MCP calls
Guard wraps LLM client calls and MCP tool calls to catch prompt injection, jailbreak attempts, prompts carrying secrets and risky tool use.
AvailableSensitive data redaction
Find secrets and personal data, such as API keys, tokens, card numbers and email addresses, in requests and responses. Block them on the way in, and redact them from responses before they leave the service.
AvailableRequest, egress and rate-limit rules
Path, method, payload and rate-limit rules on incoming requests, and allow lists for the hosts your application may call.
AvailableMonitor first, then enforce
A guardrail in Monitor mode records what it would have blocked without blocking anything. Switching it to Enforce takes an explicit confirmation, and you can switch back at any time.
AvailableWhy protection belongs inside the app.
Context a perimeter cannot see
A firewall in front of your application sees a request. Guard sees the SQL query that request turns into, and the decision log records where it happened, such as a SQL query in OrdersController, without the values.
One place to write the rules
The guardrails on the Policies page are the ones Guard enforces in every connected application. Each one reports which policy version it holds and when it last synced, so you can see what is in force where.
AI traffic needs its own checks
Prompts, model responses and MCP tool calls carry risks a network firewall does not look at: instructions hidden in content, poisoned tool descriptions and data leaving inside a completion.
How it deploys.
Write guardrails
Start from a template for HTTP, LLM, egress, redaction or rate-limit rules, and test a rule against a sample request in the app before it goes anywhere.
Add Guard to your app
Add the middleware line for your framework, or start the app with Guard's runner. A proxy or sidecar (Docker, Kubernetes with Helm, Envoy) is there for services you cannot change. Everything installs only from registry.safeguard.sh with your organisation's pull token, and you verify its signature with cosign before it runs.
Sync
Guard pulls the current policy version and keeps it in sync. The app shows each service's version, mode and last check-in.
Monitor
Decisions stream to the decision log: what was allowed, blocked, redacted or only recorded, and where in your code it happened. Values never leave your application.
Enforce
Switch a guardrail from Monitor to Enforce once you are happy with what it catches. Every change of mode is recorded.
Review
Filter decisions by service, rule, action and time, and export them for an incident review or as audit evidence.
Where teams start.
Stop SQL injection at the query
Guard checks the query your code is about to run, so an injection is caught at the database call instead of being guessed from the request.
Keep secrets and personal data out of LLM prompts
Block prompts that carry API keys, tokens or personal data before they reach a model provider, and redact them from responses before they reach a user or a log.
Screen what AI agents do through MCP
Check an agent's tool calls and the tool descriptions an MCP server returns, and block or record the ones that match an injection or poisoning pattern.
Show which rules were in force, and what they did
The decision log and each service's policy version give reviewers and auditors a record of what was enforced, where and when.
Related.
Start with Guard in Monitor mode.
Bring an application you want to protect and we will add Guard with you, in Monitor mode first.
The rest of the platform this plugs into
The work this actually does
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.