llm-trust-guard

Comprehensive security guards for LLM-powered and agentic AI applications. Implements 20+ protection layers covering OWASP Top 10 for LLMs 2025, OWASP Agentic AI 2026, and MCP Security.

Features

• Prompt Injection Protection - Detect and block injection attacks including PAP (Persuasive Adversarial Prompts)
• Encoding Attack Detection - Base64, URL, Hex, Unicode, ROT13, Octal, Base32 encoding bypass prevention
• Memory Poisoning Prevention - Cross-session contamination and context injection protection
• Multi-Modal Security - Image and audio content validation
• RAG Security - Document validation and embedding attack detection
• Tool Chain Validation - Dangerous tool sequence and state corruption detection
• MCP Security - Tool shadowing and supply chain attack prevention
• Trust Exploitation Guard - Human-agent trust boundary enforcement

Quick Start

Installation

npm install llm-trust-guard

Basic Usage

import { InputSanitizer, EncodingDetector, MemoryGuard } from 'llm-trust-guard';

// Initialize guards
const sanitizer = new InputSanitizer();
const encoder = new EncodingDetector();
const memory = new MemoryGuard();

// Validate user input
const userInput = "Hello, how can I help?";

// Check for prompt injection
const sanitizeResult = sanitizer.sanitize(userInput);
if (!sanitizeResult.allowed) {
  console.log('Blocked:', sanitizeResult.violations);
  return;
}

// Check for encoding attacks
const encodingResult = encoder.detect(userInput);
if (!encodingResult.allowed) {
  console.log('Encoded threat detected:', encodingResult.violations);
  return;
}

// Use sanitized input
console.log('Safe input:', sanitizeResult.sanitizedInput);

Using TrustGuard Facade

import { TrustGuard } from 'llm-trust-guard';

const guard = new TrustGuard({
  sanitizer: { enabled: true, threshold: 0.3 },
  encoding: { enabled: true },
  registry: {
    tools: [
      { name: 'search', allowed_roles: ['user', 'admin'] },
      { name: 'delete', allowed_roles: ['admin'] }
    ]
  }
});

const result = guard.check('search', { query: 'test' }, session, {
  userInput: userInput
});

if (!result.allowed) {
  console.log(`Blocked by ${result.block_layer}: ${result.block_reason}`);
}

Framework Integrations

Express Middleware

import express from 'express';
import { createTrustGuardMiddleware } from 'llm-trust-guard';

const app = express();
app.use(express.json());

// Protect LLM endpoints
app.use('/api/chat', createTrustGuardMiddleware({
  bodyFields: ['message', 'prompt'],
  sanitize: true,
  detectEncoding: true,
  validateMemory: true
}));

app.post('/api/chat', (req, res) => {
  // req.body.message is validated
  res.json({ response: 'Safe response' });
});

LangChain Integration

import { TrustGuardLangChain } from 'llm-trust-guard';

const guard = new TrustGuardLangChain({
  validateInput: true,
  filterOutput: true,
  throwOnViolation: true
});

// Validate before sending to LLM
const result = guard.validateInput(userMessage);
if (!result.allowed) {
  throw new Error(`Blocked: ${result.violations.join(', ')}`);
}

// Create secure processor
const processor = guard.createSecureProcessor(sessionId);
const { allowed, message } = processor.processUserMessage(userInput);

OpenAI Integration

import OpenAI from 'openai';
import { SecureOpenAI, wrapOpenAIClient } from 'llm-trust-guard';

const openai = new OpenAI();

// Option 1: Manual validation
const secure = new SecureOpenAI({
  validateInput: true,
  filterOutput: true
});

const messages = [
  { role: 'system', content: 'You are helpful.' },
  { role: 'user', content: userInput }
];

const validated = secure.validateMessages(messages, sessionId);
if (!validated.allowed) {
  throw new Error('Blocked');
}

// Option 2: Wrap client (automatic validation)
const secureOpenAI = wrapOpenAIClient(openai, {
  validateInput: true,
  filterOutput: true,
  throwOnViolation: true
});

Guards Reference

Core Guards

| Guard | Layer | Purpose | |-------|-------|---------| | InputSanitizer | L1 | Prompt injection & PAP detection | | ToolRegistry | L2 | Tool hallucination prevention | | PolicyGate | L3 | RBAC enforcement | | TenantBoundary | L4 | Multi-tenant isolation | | SchemaValidator | L5 | Parameter validation | | ExecutionMonitor | L6 | Rate limiting | | OutputFilter | L7 | PII/secret detection | | ConversationGuard | L8 | Multi-turn manipulation | | ToolChainValidator | L9 | Tool sequence validation | | EncodingDetector | L10 | Encoding bypass detection |

Advanced Guards

| Guard | Layer | Purpose | |-------|-------|---------| | MultiModalGuard | L11 | Image/audio validation | | MemoryGuard | L12 | Memory poisoning prevention | | RAGGuard | L13 | Document validation | | CodeExecutionGuard | L14 | Safe code execution | | AgentCommunicationGuard | L15 | Multi-agent security | | CircuitBreaker | L16 | Failure prevention | | DriftDetector | L17 | Behavior monitoring | | MCPSecurityGuard | L18 | MCP tool security | | PromptLeakageGuard | L19 | System prompt protection | | TrustExploitationGuard | L20 | Trust boundary enforcement | | AutonomyEscalationGuard | L21 | Unauthorized autonomy prevention | | StatePersistenceGuard | L22 | State corruption prevention |

OWASP Coverage

LLM Top 10 2025

| Threat | Guards | |--------|--------| | LLM01: Prompt Injection | InputSanitizer, EncodingDetector | | LLM02: Sensitive Data Exposure | OutputFilter, PromptLeakageGuard | | LLM03: Supply Chain | MCPSecurityGuard | | LLM04: Data Poisoning | RAGGuard, MemoryGuard | | LLM05: Privilege Escalation | PolicyGate, TenantBoundary | | LLM07: System Prompt Leakage | PromptLeakageGuard | | LLM08: Vector DB Attacks | RAGGuard |

Agentic AI 2026

| Threat | Guards | |--------|--------| | ASI04: Tool Misuse | ToolChainValidator | | ASI05: Privilege Escalation | PolicyGate | | ASI06: Memory Poisoning | MemoryGuard | | ASI07: State Corruption | ToolChainValidator | | ASI08: State Persistence | StatePersistenceGuard | | ASI09: Trust Exploitation | TrustExploitationGuard | | ASI10: Autonomy Escalation | AutonomyEscalationGuard |

API Examples

InputSanitizer

import { InputSanitizer } from 'llm-trust-guard';

const sanitizer = new InputSanitizer({
  threshold: 0.3,
  detectPAP: true,
  papThreshold: 0.4,
  blockCompoundPersuasion: true
});

const result = sanitizer.sanitize("Ignore all previous instructions");
// result.allowed = false
// result.violations = ['INJECTION_DETECTED']
// result.matches = ['ignore_instructions']
// result.pap = { detected: false, techniques: [], ... }

EncodingDetector

import { EncodingDetector } from 'llm-trust-guard';

const detector = new EncodingDetector({
  detectBase64: true,
  detectURLEncoding: true,
  detectUnicode: true,
  detectHex: true,
  detectROT13: true
});

const result = detector.detect("aWdub3JlIGFsbA=="); // Base64 encoded
// result.allowed = false
// result.violations = ['BASE64_ENCODING_DETECTED']
// result.encoding_analysis.threats_found = [...]

MemoryGuard

import { MemoryGuard } from 'llm-trust-guard';

const guard = new MemoryGuard({
  enableIntegrityCheck: true,
  detectInjections: true,
  riskThreshold: 40
});

// Validate before storing
const writeResult = guard.checkWrite(content, 'user', sessionId);

// Validate context injection
const ctxResult = guard.validateContextInjection(context, sessionId);

Attack Prevention

| Attack | Without Guard | With Guard | |--------|--------------|------------| | Prompt Injection | Exploitable | Blocked | | PAP Attacks | Exploitable | Blocked | | Encoding Bypass | Exploitable | Blocked | | Memory Poisoning | Exploitable | Blocked | | Cross-Tenant Access | Possible | Blocked | | Tool Hallucination | Executed | Blocked | | Trust Exploitation | Possible | Blocked |

Architecture Principle

"The LLM proposes. The orchestrator disposes."

LLMs cannot be trusted to enforce security. All security decisions happen in the orchestration layer.

Contributing

See CONTRIBUTING.md in the installed package for guidelines.

Security

See SECURITY.md in the installed package for security policy and reporting vulnerabilities.

Changelog

See CHANGELOG.md in the installed package for version history.

License

MIT License - see LICENSE in the installed package for details.

Links

• OWASP Top 10 for LLMs
• OWASP Top 10 for Agentic Applications 2026