Documentation — El AI Intelligence

Getting Started

Quickstart Guide — 5-minute setup with Docker. Run the demo, write a policy, integrate.
Python SDK README — Install, configure, and use the Python SDK, MCP server, and inline proxy.

Core Docs

Document	What it covers
Threat Model	What we protect against, attack taxonomy, known gaps
Policy Tuning	Writing custom policies — categories, actions, flag rules, bridges
Deployment Guide	Docker, Kubernetes, systemd, embedded Rust, C FFI
Integration Guide	SDK and API reference, MCP server, inline proxy
SLI / SLO	Reliability targets, monitoring, alerting

API Reference

`POST /check`

Check a tool call against the policy. Returns verdict without executing.

{
  "tool_name": "Bash",
  "target": "rm -rf /",
  "params": {}
}

Response:

{
  "verdict": "deny",
  "action": "rm_rf",
  "confidence": "high",
  "reason": "rm_rf IS_A destructive_op prevents execution",
  "tier": "deterministic",
  "strategy": "category_verdict",
  "latency_us": 124,
  "ellm_trace": ["rule::destructive_op_deny"]
}

`POST /forward`

Check a tool call and forward it to an upstream executor if allowed. Requires GUARDRAIL_UPSTREAM_URL to be configured.

Verdict	Behavior
Allow	Forwards to upstream, returns upstream response + `X-Guardrail-*` headers
Deny	Returns 403, never forwards
Escalate	Returns verdict by default. Set `GUARDRAIL_AUTO_FORWARD_ESCALATED=true` to forward

`GET /health`

{
  "status": "ok",
  "guardrail": "ok",
  "upstream": "ok",
  "upstream_url": "http://tool-executor:8080/execute"
}

`GET /metrics`

{
  "total_checks": 15432,
  "allow_count": 12100,
  "deny_count": 3100,
  "escalate_count": 232,
  "avg_latency_us": 127,
  "uptime_secs": 86400
}

SDK Reference

Python

from ellm_guardrail import GuardrailClient

guard = GuardrailClient()
result = guard.check("Bash", "rm -rf /")

print(result.verdict)    # "deny"
print(result.reason)     # "rm with destructive flags"
print(result.is_allowed) # False
print(result.is_denied)  # True

Full Python SDK docs →

Rust (Embedded)

use ellm_guardrail::pipeline::GuardrailPipeline;

let pipeline = GuardrailPipeline::deterministic_only();
let result = pipeline.check("Bash", "rm -rf /", &[]);
assert_eq!(result.verdict.as_str(), "deny");

Full Rust API docs →

MCP Server (Claude Code)

claude mcp add guardrail -- python -m ellm_guardrail.mcp_server

Architecture

The guardrail has two tiers:

Deterministic tier (always on): Compiles your TOML policy into a Rete forward-chaining network. Every check is the same inference — insert facts, run rules to fixpoint, read verdict. 124µs latency. No LLM. No network calls.
LLM tier (optional, Enterprise): For escalated actions, an LLM reviews the context and intent. This tier is gated behind Enterprise licensing and requires an LLM provider connection.

The deterministic tier is always the primary security boundary. The LLM tier is advisory — it can escalate to Deny but never overrides a deterministic Allow with a Deny.