LlamaFirewall

Securing agents rather than chatbots is the design center of LlamaFirewall, the guardrail framework Meta runs in production and ships inside the PurpleLlama repository. Three scanner layers cover different failure modes: PromptGuard 2, an 86M-parameter classifier with a faster 22M variant, catches jailbreaks and injected instructions in user input and untrusted tool output; AlignmentCheck, an experimental chain-of-thought auditor, reads an agent's reasoning trace to detect goal hijacking mid-plan; and CodeShield, a static analyzer, flags insecure coding patterns in generated code before it executes. Scanners compose into per-conversation pipelines alongside regex and custom rules, engineered for low-latency inline use in high-throughput agent systems. The framework code is MIT licensed and installs from PyPI as llamafirewall, while the PromptGuard model weights carry the Llama community license; the small classifiers run on CPU, so no GPU is needed for the core path. An accompanying 2025 paper documents the design and benchmark results, and Meta positions it as the open backbone for agent-side defense.