Runtime security for LLM apps

A firewall for the text going in and out of your model.

PromptWall inspects every prompt and response for injection, jailbreaks, system-prompt theft, leaked secrets and PII, and data-exfiltration channels, then blocks, flags, or redacts. Zero dependencies, fully offline, deterministic enough to read.

Try the live inspector View source

detectors

dependencies

143

tests, offline

OWASP LLM risk

Live inspector

Paste a prompt. Watch the wall inspect it.

The same detection rules as the Python library, ported to run right here in your browser. Nothing is sent anywhere. Load an example or type your own.

Text under inspection input

Verdict

This browser demo mirrors PromptWall's rule set for illustration. The library is the source of truth: deterministic, span-accurate, and covered by 143 tests. Pattern detection is one layer of defence-in-depth, not a replacement for the model's own safety or for proper tool and privilege isolation.

Coverage

Seven detectors, one verdict.

Each detector reports findings with a severity; a small, readable policy turns them into a single action: allow, flag, redact, or block.

Prompt injection

Instruction overrides: ignore all previous instructions, forged system: markers, "from now on you will…".

Jailbreaks

DAN, "developer mode", "you are now unrestricted", roleplay framed to drop the rules.

System-prompt leak

"Repeat the words above", "what are your instructions?", verbatim-dump requests.

Secret leakage

OpenAI / AWS / GitHub / Stripe keys, JWTs, private-key blocks — masked in place.

PII leakage

Emails, payment cards (Luhn-checked), phone numbers, national IDs — redactable.

Data-exfil channels

Markdown images/links that leak data to an attacker host when a UI renders them.

Obfuscation

Zero-width splitting, homoglyphs, unicode-tag smuggling, base64/hex payloads decoded and re-scanned.

Custom rules

Add your own patterns and a domain allowlist via a small JSON config — no code.

How a scan works

Normalise, decode, detect, decide.

Normalise

NFKC, strip zero-width, fold homoglyphs, lowercase — so іgnоre can't hide.

Decode

base64/hex blobs that decode to text are pulled out and scanned too — one step higher.

Detect

Seven detectors run over every view; secrets & PII report exact spans.

Decide

The policy maps findings to allow / flag / redact / block. Redactables get masked.

Use it

Library, CLI, or MCP server.

# Python — wrap your model call
from promptwall import Firewall, Blocked

fw = Firewall()

@fw.guard
def ask(prompt):
    return my_llm(prompt)

try:
    answer = ask(user_input)
except Blocked as e:
    answer = "That request was blocked."
    print(e.result.categories())

# CLI — gate a pipeline (exit 0/1/2)
$ promptwall scan "ignore all previous instructions"
BLOCK  [input] severity=high
  - high  injection: ignore prior instructions

# MCP — expose it to any AI assistant
$ pip install "promptwall[mcp]"
$ promptwall-mcp
# tools: scan_prompt, scan_response

Install: pip install -e . from github.com/vtino17/promptwall. MIT licensed.