LlamaFirewall
Meta's open-source guardrail framework combining PromptGuard 2, AlignmentCheck, and CodeShield to stop prompt injection in AI agents
Overview
LlamaFirewall is Meta's open-source guardrail framework for securing AI agents, developed by the Purple Llama team and used in production internally at Meta. Rather than a single classifier, it's a policy engine that orchestrates multiple purpose-built security scanners at different stages of an agent's workflow: PromptGuard 2 (a fast BERT-style classifier for direct prompt injection and jailbreak detection), AlignmentCheck (a chain-of-thought auditor that inspects an agent's reasoning trace for goal hijacking and indirect prompt injection from tool outputs or retrieved content), and CodeShield (static analysis of LLM-generated code for insecure patterns). LlamaFirewall builds on Meta's earlier Llama Guard lineage of safety classifiers, packaging them into a configurable, extensible pipeline that developers install via `pip install llamafirewall` and wire into agent input/output/reasoning checkpoints.
The Verdict
Who Should Use LlamaFirewall?
Best For
- Teams building autonomous or tool-using LLM agents that need defense against both direct and indirect prompt injection
- Organizations wanting a free, self-hosted, MIT-licensed alternative to commercial guardrail APIs
- Developers who want chain-of-thought auditing (AlignmentCheck) in addition to input-level filtering
- Teams generating LLM code who want a bundled static-analysis layer (CodeShield)
Not Ideal For
- Teams that need a fully managed SaaS with SLAs and dashboards rather than a self-hosted Python library
- Non-Python stacks—the framework and its examples center on a Python SDK
- Projects wanting a single lightweight classifier rather than a multi-scanner pipeline with added latency and model download requirements
What's Great
- Layered defense combines fast input classification (PromptGuard 2), reasoning-level auditing (AlignmentCheck), and code-output scanning (CodeShield) instead of relying on one model
- PromptGuard 2 is lightweight (86M and 22M parameter variants) and built for low-latency, high-throughput production use
- AlignmentCheck targets indirect prompt injection and goal hijacking, a gap most input-only filters miss
- Backed by Meta's own published research (arXiv 2505.03574) showing over 90% attack success rate reduction on the AgentDojo benchmark
- Open source and extensible—configurable scanners and custom regex rules
- Reportedly used in production at Meta, signaling real-world battle-testing
Watch Out For
- Requires downloading Meta's Llama-derived models from Hugging Face, which are gated under the Llama Community License rather than a pure permissive license
- Multi-scanner pipeline adds latency and infrastructure/model-hosting overhead compared to a single lightweight filter
- Young project (2025) relative to more established commercial guardrail vendors—expect API and scanner changes as it matures
- Benchmark claims (AgentDojo attack reduction) come from Meta's own paper; independent third-party validation is still limited
Pricing
View all features & details
Key Features
- PromptGuard 2: BERT-style classifier for direct prompt injection and jailbreak detection (86M param + 22M lightweight variant)
- AlignmentCheck: chain-of-thought auditing to catch goal hijacking and indirect prompt injection from tool/retrieval outputs
- CodeShield: static analysis of LLM-generated code via Semgrep and regex rules across 8 programming languages
- Configurable regex and custom scanners for known attack signatures and secrets detection
- Policy-engine architecture that lets scanners run at different agent workflow checkpoints (input, reasoning, output)
- Python SDK: `pip install llamafirewall`, with a `llamafirewall configure` setup command
Use Cases
- Filtering direct prompt injection attempts in user-facing LLM chat and agent inputs
- Detecting indirect prompt injection hidden in tool outputs, retrieved documents, or web content fed to an agent
- Auditing agent reasoning traces for signs of goal hijacking before executing an action
- Scanning LLM-generated code for known-insecure patterns before merge or execution
- Building layered, defense-in-depth guardrails for production autonomous agents
How It Compares
| Feature | LlamaFirewall | LLM Guard | Lakera Guard |
|---|---|---|---|
| Deployment | Self-hosted, open source | Self-hosted, open source | Managed API / SaaS |
| Direct Prompt Injection Detection | PromptGuard 2 (BERT-style) | Prompt injection scanner (Transformer-based) | Proprietary detection models |
| Indirect Injection / Agent Reasoning Auditing | AlignmentCheck (chain-of-thought auditing) | Not a core focus | Limited |
| Code Output Scanning | CodeShield (Semgrep + regex, 8 languages) | No | No |
| License | MIT (framework); Llama Community License (models) | MIT | Commercial |
| Backing | Meta (Purple Llama / used in production internally) | Community-maintained | Lakera (VC-backed startup) |
*90%+ attack success rate reduction figure is from Meta's LlamaFirewall paper (arXiv 2505.03574) on the AgentDojo agent-security benchmark.