Apache-2.0 Python library for programmable input, dialog, retrieval, execution and output rails, configured with YAML plus Colang conversation flows.
Teams building their own guardrail layer in Python who need enforcement at more than one point in the loop, since the library defines five rail stages so retrieved RAG chunks and custom tool inputs and outputs can be screened, not only the user prompt and final answer. It suits engineering groups that want the policy in version control, because models, prompts, rails and tracing are declared in config.yml alongside Colang .co flow files. It is also a reasonable base for composing several third-party checkers behind one configuration, as the docs name LlamaGuard, Presidio, Private AI, GLiNER, ActiveFence, AutoAlign, Polygraf, Pangea AI Guard, Fiddler, Cisco AI Defense, Prompt Security and Guardrails AI.
No latency figure is published anywhere in the repository or documentation: the jailbreak heuristics tutorial only calls itself a low-latency, low-cost alternative to the self-check input rail, and the repo's benchmark folder has no results surfaced in the README. No detection rate is published either, and NVIDIA's own README states the built-in guardrails 'may or may not be suitable for a given production use case' and calls evaluating the safety of LLM-based conversational applications 'a complex task and still an open research question'. It is a library rather than a managed service, so you own hosting, model serving and the compute bill for the NemoGuard NIMs, and the docs restrict NVIDIA Build endpoints to evaluation and testing with no confidential or personal data.
Pros
Cons
Apache-2.0. The repository's LICENSE.md carries the SPDX identifier Apache-2.0, a full copy of the Apache License 2.0 text ships alongside it, and the README states the library is licensed under the Apache License, Version 2.0. GitHub's own detector reports NOASSERTION because of the two licence files, but the vendor's text names an OSI-approved licence unambiguously.
At five documented stages. Input rails can reject or alter user input. Dialog rails steer how the model is prompted using canonical-form messages. Retrieval rails screen RAG chunks before they reach the model. Execution rails cover the inputs and outputs of custom actions, which is where tool calls live. Output rails can block or modify responses. Configuration lives in config.yml plus Colang .co files, with Colang 1.0 as the default.
No. Neither the repository nor the documentation publishes latency, throughput or detection-rate numbers, and although a benchmark folder exists in the repo no results appear in the README. The jailbreak heuristics tutorial describes itself only as a low-latency, low-cost alternative to the self-check input rail and demonstrates its perplexity thresholds on one malicious and one benign prompt, which cannot establish any rate.
The README states the built-in guardrails may or may not be suitable for a given production use case, and tells developers to work with their internal teams to confirm the guardrails meet their industry and use-case requirements. It also describes evaluating the safety of LLM-based conversational applications as a complex task and still an open research question. NVIDIA Build endpoints are restricted to evaluation and testing, not production.
Facts sourced from the vendor’s own site, last verified 2026-10-10.
The Weekly Source
One email a week. New listings, repriced tools, and the ones we would skip - including this one if its pricing changes.
