Groq Provider
Wrap your Groq client with Shield for prompt hardening, injection detection in user messages and tool results, and output guarding.
The shieldGroq wrapper adds Shield to your existing Groq client. It intercepts every chat.completions.create call to harden system prompts, detect injections in user messages and tool results, and redact prompt leaks, credentials, and exfiltration links from responses.
Usage
import Groq from "groq-sdk";
import { shieldGroq } from "@zeroleaks/shield/groq";
const client = shieldGroq(new Groq(), {
systemPrompt: "You are a support agent...",
});
const response = await client.chat.completions.create({
model: "openai/gpt-oss-120b",
messages: [
{ role: "system", content: "You are a support agent..." },
{ role: "user", content: userInput },
],
});How it works
On every call to chat.completions.create, Shield:
- Copies the messages array so your objects are not modified.
- Hardens every message with
role: "system"orrole: "developer"(unlessharden: false), adding the canary if you set one. Array content is replaced with a single text part. - Runs detection on every
usermessage (unlessdetect: false) and on everytoolandfunctionmessage (unlessscanToolResults: false), including earlier turns. Text parts are joined; image parts are ignored. - Calls the original Groq method.
- For every choice, checks
message.contentfor prompt leaks (unlesssanitize: falseor there is no system prompt) and runs the output guard on it (unlessoutput: false). It does the same for theargumentsof each tool call. Streaming responses are handled as described in Streaming.
Options
| Option | Type | Default | Description |
|---|---|---|---|
systemPrompt | string | system and developer messages | The system prompt to check output against. Defaults to the text of every system and developer message, joined, before hardening. |
harden | HardenOptions | false | {} | Hardening options, or false to disable |
detect | LocalDetectOptions | false | {} | Detection options for user messages, or false to disable |
scanToolResults | boolean | LocalDetectOptions | true | Detection on tool results. true uses the detect options, an object replaces them, and false disables it. detect: false does not disable it. |
sanitize | SanitizeOptions | false | {} | Prompt leak sanitization options, or false to disable |
output | ScanOutputOptions | false | {} | Output scanning options, or false to disable. By default credentials and exfiltration links are redacted. |
onOutputFindings | (findings: OutputFinding[]) => void | none | Called with the findings each time output scanning finds something |
blockOnOutputFindings | boolean | false | When true, throw OutputBlockedError instead of redacting if a finding is high or critical severity |
canary | string | boolean | none | Plant a canary in the hardened system prompt and treat its appearance in output as a leak. true creates one. See Canary. |
streamingSanitize | "buffer" | "chunked" | "passthrough" | "buffer" | How streamed output is guarded. See Streaming. |
streamingChunkSize | number | 8192 | Characters per chunk in "chunked" mode |
throwOnLeak | boolean | false | When true, throw LeakDetectedError instead of redacting a prompt leak or a canary |
onDetection | "block" | "warn" | "block" | "block" throws InjectionDetectedError; "warn" calls onInjectionDetected and sends the request anyway |
onInjectionDetected | (result: LocalDetectResult, source: "user" | "tool") => void | none | Called when injection is detected, in both modes, with where it was found |
onLeakDetected | (result: SanitizeResult) => void | none | Called when a prompt leak or a canary is found in the output |
Multi-part messages
Groq accepts content as string | ContentPart[], including messages with text and images. Shield joins the text parts for detection and hardening and ignores the rest.
Streaming
See Streaming for the three streamingSanitize modes and what each does to the stream.
shieldGroq uses the OpenAI wrapper with Groq types. The Chat Completions behavior described on the OpenAI page also applies here. The Groq SDK has no responses resource, so only chat.completions.create is wrapped. If a later version adds responses.create, it is wrapped as on OpenAI.
Anthropic Provider
Wrap your Anthropic client with Shield for prompt hardening, injection detection in user messages, tool results, and documents, and output guarding.
Google Gen AI Provider
Wrap your Google Gen AI SDK client with Shield for system instruction hardening, injection detection in user input, function responses, and inline documents, and output guarding on generateContent, generateContentStream, and chats.