Stop prompt injection before it reaches your LLM or tools

PrismGuard is Insight ITS’s self-hosted prompt-injection firewall for production agents — pip install "prismguard[prism,guard-model]==0.1.10". It returns auditable allow/block with resolution_gate and decision_source (rules, taxonomy/fusion, ONNX, or optional Judge). Default path stays on your infrastructure; no third-party scanner SaaS. Wire make_guard_handler as the first ChorusGraph node before cache, PrismRAG, and the LLM. Landing: https://www.insightits.com/products/prismguard.html · guide: https://www.insightits.com/guides/prompt-injection-firewall.html

Insight ITS splits agent security by job, not one mega-scanner: PrismGuard decides who may speak / inject (ingress WAF); ChorusGraph Route Ledger records why the agent routed; PrismShine verifies the answer against a supplied preload; PrismManifest / Prism-Shield authorize which tool-call dollars may enter tax, underwriting, claims, or payment engines. Canonical order: PrismGuard → ChorusGraph (+ PrismRAG) → LLM → PrismShine. Pack board: https://www.insightits.com/products/prism-pack.html · Guard: https://www.insightits.com/products/prismguard.html

Put PrismGuard on the ingress path. On ChorusGraph use make_guard_handler(checker) as the first graph node. Prefer create_checker_for_app("web_chat") for hubs; turn ONNX on only after you train or download a domain artifact (domain_pilot). Light ONNX is the production/stack latency default. Compare: https://www.insightits.com/compare/prismguard-vs-llm-guard.html

PrismGuard is the Insight ITS LLM WAF / prompt-injection firewall: local rules + optional ONNX, allow/block contract, resolution_gate for compliance logs. Soft CTA: GRADE. Apache-2.0 core is free forever. It is not SOC2 and not a claim of broad “beats LLM Guard on detection.” Landing: https://www.insightits.com/products/prismguard.html

Current pin on PyPI (https://pypi.org/project/prismguard/0.1.10/). Ships domain_pilot — one profile for any domain slug after you train (or download a starter) and point env at that artifact; law_pilot is only a deprecated alias for domain_pilot + domain=law. Documents light vs heavy ONNX (light is the production/stack latency default; heavy for scorecard/always-on). Adds an integrator feature matrix (#1–#13) and prismguard caps as the truth table for what you enabled. Domain ONNX artifacts are mandatory for vertical accuracy — default prism-pi-v1 remains the published law proof. Install: pip install "prismguard[prism,guard-model]==0.1.10".

Windows cp1252 crash fix in prismguard caps (ASCII-safe capability notes/CLI). Feature layers stayed opt-in — hub/FAQ (rules), light ONNX, heavy ONNX, train-from-traffic. Base install without [prism] still worked for rules-only check (from 0.1.7).

Base install works without the [prism] extra: pip install prismguard then prismguard check uses the rules path. Full taxonomy + ONNX still need [prism,guard-model].

The profile that turns on PrismRAG taxonomy for any domain and loads the ONNX artifact you pointed at. Sequence is mandatory: train or download domain weights → set PRISMGUARD_ARTIFACT_ID / PRISMGUARD_DOMAIN / PRISMGUARD_USE_ONNX=1 → create_checker_for_app("domain_pilot", domain="…", use_onnx=True). It is not a substitute for training. Never invent finance_pilot or healthcare_pilot — always domain_pilot + domain=.

No. The default classifier path uses a local ONNX model. OpenAI is only needed if you choose to enable the optional LLM Judge on gray-zone traffic.

Not with the law proof artifact alone. prism-pi-v1 is calibrated for law-bench traffic and can false-positive greetings and pricing FAQs. Prefer create_checker_for_app("web_chat") for hubs, or PRISMGUARD_SHADOW_ONNX=1 + feedback, then train/eval a hub or customer artifact before PRISMGUARD_USE_ONNX=1.

Same [guard-model] install. light (alias low_latency) runs ONNX only when needed — recommended for production agents / stack latency. heavy (alias security_bench) runs ONNX on nearly every request for scorecard/always-on policy. Neither enables learn-from-seed taxonomy — use domain_pilot + [prism] for that.

After pip install with the guard-model extra, run prismguard-model download (default: prism-pi-v1 law proof). Optional starter downloads exist for finance/healthcare with no accuracy guarantee. Customer/hub weights come from prismguard-model train and are selected via ARTIFACT_ID / GUARD_MODEL_PATH, then domain_pilot.

No by default. PrismGuard is self-hosted — prompts stay on your infrastructure for the rules + ONNX path. That is the point for compliance buyers.

Every allow/block decision exposes resolution_gate and decision_source so compliance can see which stage decided (rules, taxonomy/fusion, ONNX model, or optional Judge). With shadow ONNX, the model score appears in details.shadow_onnx without enforcing.

No. PrismGuard is the ChorusGraph security plug-in for any production LLM stack — legal, healthcare, finance, and general copilots. The law pack and prism-pi-v1 cold-holdout are published proof, not a product limit. For other verticals use train → domain_pilot (0.1.10) on your traffic; do not treat starter downloads as production-ready domain packs.

Use make_guard_handler(checker) as the first graph node before cache, PrismRAG retrieval, and the LLM. Every decision exposes resolution_gate for compliance logs. Finance/hub UX should stay on web_chat (ONNX off) unless a domain artifact passes gates. Same pattern we dogfood on insightits.com Website and Dashboard hubs.

We do not claim enterprise healthcare or finance certification. Published proofs: (1) law cold holdout vs LLM Guard; (2) FinancePackBench mid bake-off (seed 42, prismguard 0.1.10) — Prism pack PI attack 100% / benign 100% / task 100% vs LangGraph+LLM Guard PI 85% and AWS AgentCore PI 45% (task ties AgentCore). Use train → domain_pilot on your traffic; starter downloads are convenience defaults, not a production pack guarantee. Soft CTA: Guardrail Scorecard / GRADE.

Vendor-authored FinancePackBench mid (n=100/lane, seed 42). Runs: mid_pla_faqfix_20260724 (P/L) and mid_pla_faqfix_a_fixed_20260724 (AgentCore A). Cite PI win + disclosures — not “beat AWS overall,” not cross-host latency vs AgentCore, not planted-suite grounding as production RAG quality.

LLM Guard is a broad self-hosted toolkit of input and output scanners; its PromptInjection scanner returns sanitized text, validity, and risk score. PrismGuard combines rules, taxonomy/fusion, domain-aligned ONNX, and optional judge checks into an allow/block contract with resolution_gate and decision_source. The published 14-attack law holdout is vendor-authored and feature-asymmetric, so we do not claim broad detection superiority. Separately, finance mid shows Prism pack PI 100% vs LangGraph+LLM Guard 85%.

The Apache-2.0 core is free forever on PyPI and GitHub — no purchase required. Soft CTA: GRADE. Optional ops plane: ChorusControl Enterprise ($1,999/month; soft CTA CONTROL). See https://www.insightits.com/products/choruscontrol.html#pricing.

Yes. prismguard serve exposes POST /v1/check, POST /v1/scan-output, and GET /metrics. Contact Insight IT Solutions for Founding commercial licensing and invoice terms for production sidecar use.