@barric/anthropic

barric firewall wrapper for the Anthropic SDK. Drop-in replacement that scans every messages.create call for prompt injection, PII leaks, and other threats.

Install

npm install @barric/core @barric/anthropic @anthropic-ai/sdk

Quick Start

import Anthropic from '@anthropic-ai/sdk'
import { createFirewall } from '@barric/core'
import { barricAnthropic } from '@barric/anthropic'

const firewall = createFirewall({
  rules: ['prompt-injection', 'pii-redaction'],
  injection: { threshold: 0.7, action: 'block' },
  pii: { mode: 'redact', types: ['email', 'phone', 'ssn'] },
})

const client = barricAnthropic(new Anthropic(), firewall)

const response = await client.messages.create({
  model: 'claude-sonnet-4-20250514',
  max_tokens: 1024,
  messages: [{ role: 'user', content: userInput }],
})

console.log(response._barric.events) // firewall scan results

How It Works

barricAnthropic returns a thin proxy around the Anthropic client:

1. Extracts the last user message from params.messages
2. Runs it through inbound scanners (injection detection, PII redaction, rate limiting, encoding detection, input limits)
3. The sanitized input replaces the original and is forwarded to messages.create
4. Outbound scanners run on the response (output limits, system prompt leak detection)
5. The response is returned with a _barric property containing firewall metadata

If any scanner triggers a block action, the wrapper throws before the API call.

Handling Blocked Requests

try {
  const response = await client.messages.create({
    model: 'claude-sonnet-4-20250514',
    max_tokens: 1024,
    messages: [{ role: 'user', content: userInput }],
  })
} catch (err) {
  if ('_barric' in err) {
    console.log(err._barric.events) // which scanners triggered the block
  } else {
    throw err // Anthropic API error
  }
}

Per-request Context

const client = barricAnthropic(new Anthropic(), firewall, {
  context: { userId: 'user-123' },
  systemPrompt: 'You are a helpful assistant.',
})

License

MIT