@barric/core

AI prompt firewall engine for LLM applications. Scans inputs and outputs for prompt injection, PII leaks, encoding attacks, and more.

Install

npm install @barric/core

Quick Start

import { createFirewall } from '@barric/core'

const firewall = createFirewall({
  rules: ['prompt-injection', 'pii-redaction', 'input-limit'],
  injection: { threshold: 0.7, action: 'block' },
  pii: { mode: 'redact', types: ['email', 'phone', 'ssn'] },
})

const result = await firewall.guard(
  userInput,
  async (sanitized) => llm.complete(sanitized),
  { context: { userId: 'user-123', ip: req.ip } }
)

if (result.blocked) {
  console.log('Blocked:', result.events[0].scanners)
} else {
  console.log('Response:', result.filteredOutput)
}

Scanners

| Scanner | Direction | What it does | |---------|-----------|-------------| | prompt-injection | Inbound | 200+ signature patterns detecting instruction override, persona hijacking, system prompt extraction | | pii-redaction | Both | Detects and redacts emails, phones, credit cards, SSNs, IP addresses. Supports redact/mask/block modes | | rate-limit | Inbound | Sliding window rate limiter with per-user keying | | input-limit | Inbound | Character and token length enforcement | | output-limit | Outbound | Character length enforcement on LLM responses | | system-prompt-leak | Outbound | Detects if the LLM leaks your system prompt via pattern matching and n-gram similarity | | encoding-detection | Inbound | Detects zero-width characters, base64 payloads, unicode escapes, homoglyph mixing |

Configuration

createFirewall({
  rules: ['prompt-injection', 'pii-redaction', 'rate-limit', 'input-limit',
          'output-limit', 'system-prompt-leak', 'encoding-detection'],

  injection: {
    threshold: 0.7,        // Detection sensitivity (0-1)
    action: 'block',       // 'pass' | 'log' | 'warn' | 'block'
    allowlist: [],         // Phrases to never flag
  },

  pii: {
    mode: 'redact',        // 'redact' | 'mask' | 'block'
    types: ['email', 'phone', 'credit-card', 'ssn', 'ip-address'],
    reversible: true,      // Re-inject PII into LLM output
    custom: [{ name: 'employee-id', pattern: /EMP-\d{6}/ }],
  },

  rateLimit: {
    maxRequests: 20,
    windowMs: 60_000,
    keyFn: (ctx) => ctx.userId ?? ctx.ip ?? 'anonymous',
  },

  input: { maxLength: 10_000, maxTokens: 4_000 },
  output: { maxLength: 20_000, systemPromptLeakThreshold: 0.6 },

  onViolation: (event) => console.warn('Violation:', event),
  onScan: (event) => analytics.track(event),
})

PII Redaction Flow

PII redaction is reversible by default — personal data is stripped before reaching the LLM, then re-injected into the output:

User input -> [email redacted] -> LLM processes sanitized text -> PII re-injected -> Response

SDK Wrappers

Use @barric/core directly, or with a provider wrapper:

• @barric/openai — OpenAI SDK wrapper
• @barric/anthropic — Anthropic SDK wrapper
• @barric/next — Next.js Route Handler middleware

License

MIT