Shield SDK

Version 2.0.0 is available on npm. Upgrading from 1.x? Start with the migration guide.

@zeroleaks/shield is an MIT-licensed runtime security package for LLM applications and agents. It checks model input and output:

• In: prompt injection and jailbreaks in user messages, and indirect injection in retrieved documents and tool results, including obfuscated and encoded attacks. Tool definitions from MCP servers are checked for tool poisoning.
• Out: system prompt leaks (even obfuscated or encoded), credentials, personal data, and markdown images or links that would send data to someone else's server.

The default asynchronous detect export calls the Shield API, with four hosted model IDs and an OpenAI-compatible protocol. Start with the API quickstart. Explicit @zeroleaks/shield/local exports provide in-process detection, and @zeroleaks/shield/model loads locally configured model artifacts. Hardening, output scanning, and tool policy checks remain local.

For model access and content handling, see models and plans. The archived benchmark describes an earlier SDK evaluation and does not identify the current hosted release.

Shield's detection is a guardrail, not a permission system. A tool policy adds rules you write for the agent's tool calls: which tools it may call and with which arguments, and which tools may no longer send data out once it has read untrusted content. Neither can stop an agent from misusing a permission it legitimately holds. To find those problems, run ZeroLeaks agent scans against the agent itself.

Core functionsCopy Anchor Link

detect() asynchronously checks text with the hosted Shield API. The synchronous rules detector is detect from @zeroleaks/shield/local. Use it on user messages and on anything else that reaches the model: documents, web pages, emails, and tool results. The local detectConversation() scans a whole conversation and catches instructions split across turns.

sanitize() finds system prompt text in model output and redacts it.

scanOutputText() finds credentials, personal data, exfiltration links, and canary tokens in model output and redacts them.

harden() adds security rules to a system prompt. spotlight() marks untrusted content so the model can tell it apart from instructions.

scanTools() checks tool definitions locally. Use scanToolsAsync() with a hosted detector to await model-backed checks.

createToolPolicy() decides whether each tool call may run: declared tools, argument schemas, allow and deny lists, call limits, and a flow rule that refuses tools that send data out once the agent has read untrusted content.

Provider wrappersCopy Anchor Link

The model wrappers combine input and output checks on each call. They use local detection unless you explicitly pass a hosted detector through its options() method. Injections in user messages and tool results are blocked by default: the wrapper throws InjectionDetectedError before the request is sent. Output is sanitized and scanned, and leaks are redacted. The agent framework and MCP integrations apply checks at the points described on their reference pages.

• OpenAI: shieldOpenAI(client, options) wraps chat.completions.create and responses.create
• Anthropic: shieldAnthropic(client, options) wraps messages.create
• Groq: shieldGroq(client, options) wraps chat.completions.create
• Google Gen AI: shieldGoogleGenAI(ai, options) wraps models.generateContent, models.generateContentStream, and chats
• Mistral: shieldMistral(client, options) wraps chat.complete and chat.stream
• LangChain.js: shieldChatModel(model, options) guards any chat model, and ShieldCallbackHandler checks chains and agents you don't wrap
• Vercel AI SDK: shieldLanguageModelMiddleware(options) with wrapLanguageModel on AI SDK 4, 5, 6, or 7, or shieldMiddleware(options) to run each step yourself
• OpenAI Agents SDK: shieldInputGuardrail(), shieldOutputGuardrail(), shieldToolInputGuardrail(), shieldToolOutputGuardrail(), and shieldToolPolicyGuardrail() plug into an agent's and its tools' guardrails
• MCP client: shieldMcpClient(client, options) leaves poisoned tools out of listTools(), checks what tools, resources, and prompts return, and applies a tool policy to tool calls

Next stepsCopy Anchor Link