LLM Firewall Tools for Runtime Prompt and Response Filters
Runtime filters for injection, jailbreaks, and sensitive data on the model path.
EchoLeak (CVE-2025-32711) showed a zero-click path where a crafted email coerced Microsoft 365 Copilot into exfiltrating context without the user clicking anything.
Most teams already flipped a provider safety toggle and watched the dashboard stay green. That control still sits inside the same trust boundary the model uses to read mail, tickets, and RAG chunks. When those chunks carry hidden instructions, the green toggle does not stop sensitive data from leaving on the response path.
An LLM firewall is the runtime filter on prompts and responses: injection and jailbreak detection inbound, data-leak and policy filters outbound. It is not an LLM API gateway for keys and logs, and it is not the MCP gateway that decides which tool call may run. The broader rails-and-eval mix stays on LLM security tools.
This shortlist mixes specialist GenAI firewalls, hyperscaler guardrail APIs, one mid-stage platform with realtime session enforcement, and one open-source proxy that sanitizes the agent web path before content reaches the model.
How we evaluated
We read first-party product pages, docs, and licenses. We asked whether the product filters prompts and responses at runtime, whether injection and data-leak controls are named jobs, whether enforcement is inspect-only or block, and whether you call a managed API or run the filter yourself. Marketing pages count as claims, not as a lab bake-off.
| Tool | Best for | What to check |
|---|---|---|
| Prompt Security | Enterprise GenAI firewall across workforce, apps, and agents | Commercial · SentinelOne · quote |
| Lakera Guard | Managed prompt/response Guard API for injection defense | Commercial · Check Point · docs API |
| Google Model Armor | Cloud templates for prompt/response screening | Google Cloud · inspect or block |
| Amazon Bedrock Guardrails | ApplyGuardrail policies across Bedrock and other FMs | AWS · prompt attack + PII policies |
| Noma Security | Realtime agent session enforcement with discovery | Commercial · mid-stage platform |
| FireClaw | OSS proxy that sanitizes agent web fetches | AGPL · early · you run it |
Prompt Security
Best for an enterprise GenAI firewall across workforce tools, apps, and agents
Prompt Security sits inside the SentinelOne Singularity platform as a GenAI firewall. First-party pages document realtime enforcement that blocks adversarial prompts, scrubs sensitive outputs, and governs AI usage across employee tools, developer assistants, custom apps, and agents.
The product also inventories shadow AI and MCP servers, then applies policy at the interaction point rather than after a ticket is filed. If the MCP tool-call cut is your primary hole, the sibling MCP gateways shortlist covers that path with Prompt Security in the gateway job.
Key features:
- Realtime AI firewall for prompts and outputs
- Shadow AI and MCP discovery with searchable audit logs
- Policy across workforce AI, code assistants, apps, and agents
- Claims coverage across 15,000+ AI services on first-party pages
Why we like it:
When the buyer needs one desk that spans unsanctioned ChatGPT use and production agents, Prompt Security is the firewall-shaped answer rather than a pure gateway proxy.
Limits:
Commercial, demo and quote. Packaging lives inside SentinelOne. Public pages are not a latency scorecard.
License or pricing: Commercial. Demo CTAs. No public per-seat list price on the pages we read.
Lakera Guard
Best for a managed Guard API that screens prompts and responses for injection
Lakera Guard is the classic managed prompt firewall API, now documented under Check Point AI Agent Security. Docs describe realtime protection against prompt injection, jailbreaks, data leakage, and unsafe agent actions with low advertised latency.
You call the Guard path from your app or gateway. Detectors flag or enforce; they do not replace tool allowlists or identity on the MCP hop. Teams that already shortlisted Lakera for MCP should treat this page as the prompt/response filter job, not a second gateway catalog.
Key features:
- Managed Guard API for inputs and outputs
- Prompt injection and jailbreak detectors
- Data leakage and policy violation controls
- Agent discovery and runtime enforcement messaging after the Check Point acquisition
Why we like it:
When the architecture is “call a Guard endpoint before the model,” Lakera remains the reference product buyers already know how to wire.
Limits:
Commercial. Current public price cards are thin after the acquisition. An API you invoke is not a transparent local proxy.
License or pricing: Commercial. Docs historically advertise a free start. We could not confirm a current public list price.
Google Model Armor
Best for Google Cloud templates that screen prompts and responses inline
Model Armor is Google Cloud’s model-agnostic screening service for LLM prompts and responses. Docs cover prompt injection and jailbreak detection, responsible AI categories, Sensitive Data Protection, and malicious URL detection, with templates and floor settings for org baselines.
Enforcement is explicit: Inspect only logs verdicts, or Inspect and block stops the prompt or response. That split matters when you are tuning false positives before cutting over to block mode.
Key features:
- Prompt and response sanitization APIs
- Injection and jailbreak detectors with confidence thresholds
- Sensitive Data Protection integration for PII and secrets
- Floor settings for project-wide minimums
Why we like it:
Honest cloud packaging: templates, confidence levels, and inspect-versus-block are documented as operations, not vibes.
Limits:
Google Cloud commercial service. Docs note single-turn inspection without conversation history and no decoding of Base64-style obfuscation. Image and document screening have modality limits.
License or pricing: Commercial Google Cloud metering. Sold standalone or with Security Command Center. Confirm current SKU rates in Cloud pricing.
Amazon Bedrock Guardrails
Best for ApplyGuardrail policies across Bedrock and third-party models
Bedrock Guardrails packages content filters, prompt attack detection, denied topics, word filters, sensitive information filters, contextual grounding, and Automated Reasoning checks. The ApplyGuardrail API lets you assess content without invoking a foundation model, including third-party models outside Bedrock.
First-party marketing cites blocking up to 88% of harmful content and high accuracy for Automated Reasoning explanations. Treat those as vendor claims to validate on your traffic, not as a portable score.
Key features:
- ApplyGuardrail API for prompts and responses
- Prompt attack detection alongside content and topic policies
- PII and custom regex sensitive-information filters
- Cross-account safeguards for org-wide baselines
Why we like it:
If AWS already owns the AI estate, Guardrails is the firewall-shaped control that stays inside the same IAM and org story.
Limits:
AWS metered commercial service. Policy design and false-positive tuning are still your job. Not a workforce shadow-AI discovery product.
License or pricing: AWS commercial metering. Confirm unit prices on the Bedrock Guardrails pricing page for your region.
Noma Security
Best for realtime agent session enforcement with discovery and red-team loops
Noma markets an end-to-end AI security platform: discover agents, models, MCP servers, and tools; govern what they may do; probe for injection and leakage; then monitor the behavioral chain of prompts, tool calls, and data access in realtime.
Open Enforcement is the packaging claim that matters for firewall buyers: policy defined once, enforced through hooks, MCP gateways, AI gateways, SDKs, and APIs without forcing every call through one choke proxy.
Key features:
- Discovery across cloud, SaaS, and developer environments
- Realtime detection for injection, exfiltration, and scope violations
- Built-in adversarial probing for apps and agents
- Enforcement points across hooks, gateways, SDKs, and APIs
Why we like it:
Mid-stage platform that treats the session, not the single prompt string, as the unit of enforcement. That matches how agent failures actually cascade.
Limits:
Commercial quote. Broader than a thin Guard API, so expect a platform evaluation. Not a free OSS library.
License or pricing: Commercial. Sales-quoted. No public list price on the public pages we read.
FireClaw
Best for an open-source proxy that sanitizes agent web fetches before context
FireClaw is an AGPL security proxy aimed at prompt injection that arrives through web content. The four-stage pipeline does DNS blocklist checks, structural sanitization, isolated LLM summarization, and output scanning, with a documented no-bypass design.
That is the OSS job on this list: own the fetch path. It is not a drop-in enterprise Guard SaaS for every SaaS copilot in the company.
Key features:
- Four-stage sanitization pipeline for agent web fetches
- DNS threat feeds plus community detection metadata
- Canary tokens to detect summarization bypass
- JSONL audit logging and rate limits
Why we like it:
Real open-source proxy architecture with an honest AGPL license file, not a parked README.
Limits:
Early project. OpenClaw-oriented integration. AGPL has distribution implications. Injection that arrives through tool descriptions or memory, not the web proxy, still needs another layer.
License or pricing: AGPL-3.0. You host it. No paid tier on the pages we read.
How to choose an LLM firewall
- Start from the leak path. If sensitive data leaves through chat responses, buy prompt/response filters first. If the agent fetches hostile pages, prioritize a fetch-path proxy like FireClaw or a Guard call on retrieved chunks.
- Count the enforcement points. One Bedrock app can live on ApplyGuardrail. A mixed SaaS-copilot estate usually needs Prompt Security, Lakera, or Noma-style coverage outside a single cloud account.
- Separate inspect from block. Model Armor documents inspect-only tuning for a reason. Turning block on before you measure false positives will stall the AI program.
- Keep red teaming off this seat. Continuous attack simulation belongs on the LLM red team tools list. Feed findings into firewall policy; do not confuse the two RFPs.
What we left out
- NeMo Guardrails, Guardrails AI, Azure AI Content Safety, and Promptfoo: those seats already live on LLM security tools.
- Protect AI LLM Guard: the upstream README is archived, so it fails the live-tool bar.
- Sunglasses, MCP-Bastion, HiddenLayer MCP packaging: those seats belong on MCP gateways.
- Cloudflare AI Gateway, Portkey, LiteLLM, Helicone, Kong AI Gateway: auth, logs, and egress live on LLM API gateways.
- PromptArmor: the live product is AI vendor risk intelligence, not a runtime prompt firewall.
What practitioners argue about LLM firewalls
Live threads keep returning to the same tension: classifiers catch many known injections, but semantic and out-of-band paths still slip past a single detector. Proxies help on the fetch path; they do not magically cover tool metadata.
Hacker News · March 2026
“Proxy catches what passes through. Injection via tool descriptions or memory artifacts doesn’t pass through. We handle it at the content evaluation layer, not the network layer.”
That pushback on the FireClaw Show HN is the honest limit of a web-path firewall. Tool schema and memory still need evaluation outside the proxy.
Hacker News · April 2026
“Most of the defenses discussed here (Lakera, LLM Guard, Prompt Shields) are detection layers – they try to classify whether an input is malicious before it reaches the model.”
The dissenting argument in that thread is that some teams move policy to outputs and actions because semantic intent is hard to label on the inbound string alone. Firewalls still matter; they are not the whole agent control plane.
OWASP GenAI · LLM01:2025
“Given the stochastic influence at the heart of the way models work, it is unclear if there are fool-proof methods of prevention for prompt injection.”
OWASP still lists input and output filtering next to privilege control and human approval. A firewall is necessary mitigation, not a silver bullet.
If you need a managed Guard call in front of many apps, start with Lakera or Prompt Security. If traffic already lives in one cloud fabric, wire Model Armor or Bedrock Guardrails before buying a second desk. Put Noma on the quote when discovery and session chains are half the pain. Use FireClaw for the agent fetch path you are willing to operate.
FAQs
Is this the same page as LLM security tools?
No. That page mixes rails frameworks, scanners, and evals. This page is the runtime firewall cut: filters on prompts and responses for injection, jailbreaks, and data leaks.
Does an LLM firewall replace an LLM API gateway?
No. Gateways terminate keys, logs, and routing. Firewalls decide whether prompt or response content is allowed. Many estates run both.
Is FireClaw ready for enterprise SaaS copilots?
Not as a drop-in. It is an early AGPL proxy for agent web fetches. Enterprise workforce copilots usually need a managed firewall desk.
Is this a scored bake-off?
No. Order is editorial.
