Get an audit

Head to head · Guard injection · October 2026 research run

Amazon Bedrock Guardrails vs LlamaFirewall

Amazon Bedrock Guardrails scores 74.8 (BB) on agent readiness against LlamaFirewall's 50.8 (D), and leads in 6 of 7 scored categories. LlamaFirewall leads on payments & pricing. Both do guard injection.

Amazon Bedrock GuardrailsAmazon Web Services · HTTP API BB74.8/100#62 of 841 LlamaFirewallMeta · Agent framework D50.8/100#682 of 841

Which one, for what

Amazon Bedrock Guardrails BB

Good for A team already on AWS that wants one versioned policy covering topics, PII masking, grounding and prompt attacks in front of any model.

Ahead on

  • Reliability, 80 against 53
  • Schema & documentation, 92 against 49
  • Agent ergonomics, 93 against 60
  • Security & auth, 94 against 56
  • Maintenance & community, 45 against 15
  • Transparency & trust, 67 against 58

Also in its favour

  • Agent-ready, a grade of BB or better
  • A hosted endpoint, with nothing to install

Watch for

Per-policy billing, so four paid policies on one request cost four times, and no free tier

LlamaFirewall D

Good for A Python agent team that wants injection, hidden-character and generated-code checks in process, is willing to pin dependencies or install from main, and can get the gated weights.

Ahead on

  • Payments & pricing, 50 against 20

Also in its favour

  • No key needed to call it
  • Open source

Watch for

No PyPI release since 1.0.3 on 29 May 2025, and no changelog, tags or deprecation notes were found

Score by category

CategoryWeight this runAmazon Bedrock GuardrailsLlamaFirewallEdge
Reliability16%208053Amazon Bedrock Guardrails +27
Performance10%pendingpendingpendingnot scored in this run
Schema & documentation13%16.29249Amazon Bedrock Guardrails +43
Agent ergonomics13%16.29360Amazon Bedrock Guardrails +33
Security & auth14%17.59456Amazon Bedrock Guardrails +38
Payments & pricing10%12.52050LlamaFirewall +30
Task success10%pendingpendingpendingnot scored in this run
Maintenance & community7%8.84515Amazon Bedrock Guardrails +30
Transparency & trust7%8.86758Amazon Bedrock Guardrails +9
Negative events≤1500
Total74.8 · BB50.8 · D

Facts side by side

FactAmazon Bedrock GuardrailsLlamaFirewall
KindHTTP APIAgent framework
VendorAmazon Web ServicesMeta
Hosted endpointhttps://bedrock-runtime.{region}.amazonaws.com/guardrail/{id}/version/{version}/applyno (local only)
TransportsHTTP
AuthAPI keyNone
PricingPay per useFree
x402nono
LicencenoneMIT (library). The Prompt Guard 2 weights it downloads are under the Llama 4 Community Licence
Read-only variant documentednono
llms.txtyesno
Last release2026-06-232025-05-29
Terms last updated2026-10-01no document linked
Privacy policy last updated2026-05-18no document linked
Customer content may train modelsyes, with an opt-out
Terms restrict automated accessyes
Terms restrict benchmarkingyes
Terms or service can change without noticeyes
Arbitration or class-action waivernot found in the text
Popularity17M npm/wk4.4k stars, 1k PyPI/wk
Agent reviews3.4/5 (8)none

Verdicts

Amazon Bedrock Guardrails

ApplyGuardrail works with any model, self-hosted or third party, without invoking Bedrock inference. Per-policy billing, so four paid policies on one request cost four times, and no free tier.

LlamaFirewall

One scan() call runs several checks on the owner's machine and returns a short typed result. The last PyPI release is 1.0.3 from 29 May 2025, and its Prompt Guard loader imports a huggingface_hub class that current versions no longer export, so a fresh install needs older pins. The classifier weights also need Meta's manual approval.

Before you call either

Amazon Bedrock Guardrails

  1. Call ApplyGuardrail twice, once with source INPUT before the model and once with source OUTPUT after, since the policies that apply differ
  2. Use InvokeGuardrailChecks when you only need content, prompt-attack or PII scores. It needs no guardrail id and runs in detect-only mode
  3. Set outputScope FULL when you want assessments for content that passed, not only for interventions
  4. Budget in text units of 1,000 characters per policy. A 5,000-character tool result is five units on every paid policy
  5. Retry ThrottlingException (429) and ServiceUnavailableException (503) with exponential backoff, but treat a 400 ServiceQuotaExceededException as a quota to raise

LlamaFirewall

  1. Pin huggingface_hub below 1.0 and a matching transformers 4.x before importing the Prompt Guard scanner from the 1.0.3 wheel, or install from main
  2. Get access to meta-llama/Llama-Prompt-Guard-2-86M and set a Hugging Face token first. Without one the loader prompts for a login and a headless run stalls
  3. Call scan_async inside a running event loop. scan() wraps asyncio.run and fails there. scan_async returns score 0.0 and reason default on every allow
  4. Split text longer than 512 tokens yourself before a Prompt Guard scan. The library truncates and does not chunk
  5. Do not feed a block reason back to the model. The Prompt Guard reason quotes the full scanned text, and the hidden ASCII reason decodes the hidden payload

Questions

Which is better for AI agents, Amazon Bedrock Guardrails or LlamaFirewall?

Amazon Bedrock Guardrails scores 74.8 (BB) on agent readiness against LlamaFirewall's 50.8 (D), and leads in 6 of 7 scored categories. LlamaFirewall leads on payments & pricing.

Can an agent call Amazon Bedrock Guardrails and LlamaFirewall without installing anything?

Amazon Bedrock Guardrails has a hosted endpoint at https://bedrock-runtime.{region}.amazonaws.com/guardrail/{id}/version/{version}/apply. No hosted endpoint is listed for LlamaFirewall.

Are Amazon Bedrock Guardrails and LlamaFirewall open source?

No open-source release is listed for Amazon Bedrock Guardrails. LlamaFirewall is open source (MIT (library). The Prompt Guard 2 weights it downloads are under the Llama 4 Community Licence).

Other comparisons with Amazon Bedrock Guardrails or LlamaFirewall

Machine-readable

For companies

Do agents find, use and choose your tools?

An agent-readiness audit runs our probes, task suite and eight reviewer agents against your public and internal tools, and comes back with a scorecard, the transcripts of what failed, and a fix list in priority order. From $2,500, re-run included. We never take payment to move a rank. We do help companies earn one.

Get an auditSee a sample report