Inferwall
Inferwall is a self-hosted AI firewall for checking inputs and outputs in LLM applications.
What Inferwall is
Inferwall is a self-hosted AI firewall for checking inputs and outputs in LLM applications. It scans for threats such as prompt injection, jailbreaks, data leakage, and unsafe content using heuristic, machine-learning, semantic, and configurable LLM-judge layers. It can run as a Python SDK, HTTP server, or transparent reverse proxy. Listed wrappers include OpenAI, Anthropic, LangChain, and FastAPI, with additional integrations such as Ollama, Hugging Face, LlamaIndex, Pydantic, vLLM, and Mistral. Teams can set allow, flag, or block thresholds for each route and add or override signatures and version policies under ~/.inferwall/. The Lite profile is about 8 MB and needs no GPU; Standard adds about 730 MB of models, while Full adds the LLM-judge layer and requires LLM credentials. The site reports that the Rust heuristic engine runs in under 0.3 ms at p99. The engine is Apache 2.0 licensed, and community signatures use CC BY-SA 4.0. Inferwall cautions that detection is imperfect and positions the product as one part of a defense-in-depth strategy.
Good
- Scans for prompt injection, jailbreaks, leakage, and unsafe content
- Offers Python SDK, HTTP server, and reverse-proxy deployment
- Route policies can allow, flag, or block
- Signatures can be added or overridden
- Lite profile needs no GPU
Watch out
- Full profile requires LLM credentials
- Standard profile adds about 730 MB of models
- Detection is not perfect
Who it suits
Inferwall suits teams building LLM applications that want self-hosted input and output checks with configurable route policies. Its deployment options and integrations may suit teams using the listed frameworks and model stacks.
Verdict
Inferwall offers multiple deployment options, detection layers, and configurable route policies for LLM applications. Its own caveat is important: it is one layer in a defense-in-depth approach, not a perfect detection system.
The facts
Each one read from Inferwall's own pages, with the date it was checked.
What it does
- Additional ecosystem support
- The site lists Ollama, Hugging Face, LlamaIndex, Pydantic, vLLM, and Mistral among supported stack integrations.checked 5 Oct 2026
- Caveat
- The site says no detection system is perfect and describes Inferwall as one layer in a defense-in-depth strategy.checked 7 Oct 2026
- Deployment
- It can run as a Python SDK, standalone HTTP server, or reverse proxy.checked 7 Oct 2026
- Detection layers
- It combines heuristic, ML classifier, semantic, and configurable LLM-judge detection layers.checked 7 Oct 2026
- Install profiles
- The site describes Lite as about 8 MB, Standard as including about 730 MB of models, and Full as including those models plus LLM credentials.checked 5 Oct 2026
- Integrations
- The site lists first-party wrappers for OpenAI, Anthropic, LangChain, and FastAPI.checked 7 Oct 2026
- License
- The engine is Apache 2.0 and community signatures are CC BY-SA 4.0.checked 7 Oct 2026
- Licensing
- The engine is licensed under Apache 2.0 and community signatures under CC BY-SA 4.0.checked 5 Oct 2026
- Limitations
- The site states that no detection system is perfect and presents Inferwall as one layer of a defense in depth strategy.checked 5 Oct 2026
- Performance
- The site says its Rust heuristic engine runs in under 0.3 ms at p99 and the Lite profile requires no GPU.checked 7 Oct 2026
- Policy controls
- Users can set allow, flag, or block thresholds per route and extend or override signatures under ~/.inferwall/.checked 5 Oct 2026
- Profiles
- The listed Lite profile is about 8 MB; Standard adds about 730 MB of models; Full adds the LLM-judge layer and requires LLM credentials.checked 7 Oct 2026
- Purpose
- Inferwall scans LLM app inputs and outputs for prompt injection, jailbreaks, data leakage, content safety issues, and agentic threats.checked 7 Oct 2026
- Rules
- Users can override shipped signatures, add their own, and version policies under ~/.inferwall/.checked 7 Oct 2026
Where it runs
- Security mapping
- The site says its prompt injection, jailbreak, prompt extraction, and data leakage signatures map to MITRE ATLAS techniques AML.T0051, AML.T0054, AML.T0056, and AML.T0057.checked 5 Oct 2026
Alternatives to Inferwall
- 1

PromptGuard
Free planWebAPIExtensionLinux7.9From $19 a month - 2
Prompt Inspector
Free planOpen sourceWebAPILinuxmacOS7.6Free plan - 3
CyberSecEval
Free planOpen sourceWebAPILinuxmacOS7.5Free plan - 4

NVIDIA NeMo Guardrails
Free planOpen sourceAPILinuxmacOSSelf-hosted7.4Free plan - 5
Openlayer Guardrails
Free planWebAPISelf-hosted6.9Free plan - 6

GuardionAI
WebAPILinuxmacOS6.8
