A guardrail that an application has to remember to call is a guardrail that sooner or later gets skipped: a new endpoint, a rushed release, a script written in an afternoon. The dependable place for a check is the request path itself, so that nothing reaches the model, and nothing reaches the user, without passing through it.
That is how Guardrino is offered. The inspect API stays, for apps that want to ask a question. The integrations below put Guardrino where the traffic already flows; the list at the end shows what is available today.
Every path runs the same checks as the inspect API, so one policy and one audit log cover them all. The developer documentation from HisnLabs has a page each for the proxy, LiteLLM and MCP, with examples and the limits that remain.
An OpenAI-compatible proxy: change one URL
Guardrino exposes POST /v1/chat/completions. An app that speaks the OpenAI chat API changes only its base URL. Guardrino checks the user’s turns, the context the model reads as data (tool results, documents, and image or file parts, which go through the extract service first), and the reply. A refusal comes back in the OpenAI error shape, so the app’s existing error handling keeps working.
Streamed replies are checked as they grow
A reply that arrives in pieces cannot be judged only at the end. Guardrino reads a streamed reply as it accumulates. If it breaks policy, the stream ends with an error event. Chunks already sent cannot be recalled, so for cases where nothing may be shown before it is checked, buffer_output = true holds the reply until the whole of it has passed.
Every model behind LiteLLM
Teams that route many models through LiteLLM do not want one guardrail per model. Guardrino can run as a LiteLLM custom guardrail, before and after the call, or sit in front of LiteLLM with LiteLLM as its upstream. Either way, one set of checks covers every model behind it.
MCP tools: descriptions and results are input too
An agent reads a tool’s description as if it were an instruction, and it reads a tool’s result as if it were information it can trust. Both are text someone else wrote. The MCP security proxy sits between the agent and its MCP servers. It checks tool descriptions when tools are listed, checks the arguments going out (canary token, personal data, URLs), and reads the results coming back as context, in windows.
- Descriptions are checked when tools are listed.
- Arguments are checked on the way out.
- Results are checked on the way back, like any document the model reads.
Where each integration stands
- Inspect API: Available
- OpenAI-compatible proxy: Available
- Streaming checks (server-sent events): Available
- LiteLLM guardrail plugin: Available
- MCP security proxy: Available
The LiteLLM plugin, its tests and ready-to-run examples for the proxy, streaming and MCP are open source on GitHub, under the Apache-2.0 licence.
How Guardrino and HisnLabs fit in
Guardrino is built to sit in the request path: an OpenAI-compatible proxy, a LiteLLM guardrail and an MCP security proxy are available, so the check happens where the traffic already flows.