Safety scanning you own and control
A stream-aware guardrail chain that runs before, during and after every call, and on MCP tool calls. About twenty scanner types ship — moderation, PII, prompt injection, DLP, local secret redaction, your own webhook — and each can block or mask.
"Guardrails as plugins, not a security suite acquisition."
Pre-call scanning
Inspect the prompt before it ever reaches a provider — block prompt injection, policy violations, or PII on the way in.
Mid-stream, windowed
Guardrails run during streaming on a rolling window. A block aborts the client stream mid-flight; a mask rewrites or redacts as tokens flow.
Post-call scanning
Scan the completed response before it is returned or logged, catching anything the earlier passes could not see in isolation.
Guardrails as plugins
A named chain of scanners you choose and bind to an org, team, user, application or key — not PII heuristics hard-wired into the gateway process.
Scanners that ship
OpenAI moderation, Presidio, Lakera, Bedrock, Azure Content Safety, Purview, Model Armor, local secret redaction, decision-model checks and a generic webhook, among others.
Block · mask · redact
Scanners block or mask, and a mask can redact the rest of a stream. Each item also states whether a scanner error fails open or closed.
MCP tool calls
Opt-in pre_mcp_call and post_mcp_call modes screen tool arguments and results. A block becomes a tool error the model can read, not a protocol failure.
Reversible pseudonyms
A transform replaces names before the call and restores them in the stream as it flows, holding back incomplete tails until they are safe to send.
Scoped and inspectable
Floor, primary and append bindings combine per request, and an inspector shows the effective chain for any key before production traffic reaches it.
Step by step
- 01
Configure the chain
Pick scanners from the catalog — moderation, PII, prompt injection, secret redaction or your own webhook — order them into a chain, and bind it to a scope.
- 02
Scan before the call
The prompt is run through the pre-call stage. A blocking finding stops the request before any provider spend.
- 03
Watch the stream
During streaming, a rolling window is scanned continuously. A block aborts the stream; a mask rewrites offending spans in place.
- 04
Verify the output
The finished response passes the post-call stage before it reaches the client or the logs — nothing sensitive slips through on the way out.
guardrails:
items:
- name: pii
type: presidio # PII detection
mode: [pre_call, post_call]
- name: moderation
type: openai_moderation
mode: [pre_call]
on_error: fail_closed
- name: own-scanner
type: http # your own scanner
url: https://guard.internal/scan
chains:
- { name: baseline, item_names: [pii, moderation, own-scanner] }Guardrails is one of six control surfaces enforced in the same request path, applying to every application behind the endpoint — including the ones that were never instrumented.
See how they combineOne endpoint. Every model. Complete control.
Run it in your own infrastructure
Everything you need to run a control plane in production is Apache-2.0 and stays that way — routing, HA, caching, failover, budgets, policy, MCP, jobs and observability. Self-hosted, no account, no phone-home.
$ docker run -p 4000:4000 <registry>/waeg-gateway:<version>Not a working pull: the images are not public yet. Design partners receive the registry details privately.
Deploy in 5 minutesShape it as a design partner
Wäg is not publicly released yet. We are working with a small cohort of teams running multi-provider AI in production, and serious about governance and sovereignty, to harden the control plane on real workloads.
- Every Enterprise capability included, at no licence cost
- Hands-on migration — we do it with you, including from LiteLLM
- A direct line to the engineers building it, and real influence on what ships next