{ "data": { "a": { "slug": "guardrails-ai", "name": "Guardrails AI", "vendor": "Guardrails AI (Harvey)", "vendorUrl": "https://www.guardrailsai.com", "kind": "framework", "category": "guardrails", "summary": "Open-source Python framework for validating LLM inputs and outputs, with configurable actions for failed checks and an API server.", "url": "https://www.anchorterminal.com/tools/guardrails-ai", "markdownUrl": "https://www.anchorterminal.com/tools/guardrails-ai.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/guardrails-ai.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/guardrails-ai.json", "dns": "guardrails-ai.grade.anchorterminal.com", "repo": "https://github.com/guardrails-ai/guardrails", "license": "Apache-2.0", "transports": [ "http" ], "packages": [ { "registry": "pypi", "name": "guardrails-ai" }, { "registry": "npm", "name": "@guardrails-ai/core" } ], "auth": "none", "authNotes": "None of its own since the Hub closed. Validators install from public PyPI as `guardrails-ai-\u003cname\u003e` with no `guardrails configure` step, and the models behind them run locally or on an endpoint you host. The server has no built-in auth.", "pricing": "free", "pricingNotes": "Apache-2.0 library and server. The hosted remote inference that some validators used (detect_pii, toxic_language, competitor_check, nsfw_text) was free and was switched off on 2026-08-25, so those validators now cost whatever it takes to run their models yourself with use_local=True or on your own endpoint (https://github.com/guardrails-ai/guardrails/blob/main/HUB_UPDATE.md).", "priceSummary": "Free · OSS", "where": "library", "x402": { "level": "no", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 7300, "npmWeekly": 81, "pypiWeekly": null, "asOf": "2026-09-30" }, "docsUrl": "https://www.guardrailsai.com/docs", "capabilities": [ "guard.injection", "guard.pii", "guard.moderation", "guard.policy", "guard.self-host" ], "tags": [ "framework", "open-source", "self-hosted", "local", "python", "free", "openai-compatible", "incidents" ], "lastRelease": "2026-08-14", "graded": true, "anchor": { "graded": true, "score": 47.8, "grade": "D", "agentReady": false, "rank": 1140, "ranked": true, "rankOf": 1510, "categoryRank": 16, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 63, "maintenance": 44, "payments": 60, "reliability": 58, "schema": 59, "security": 44, "transparency": 61 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-04" }, "negative": -8, "negativeNotes": [ "2026-05-11 supply-chain compromise. An attacker used an employee's GitHub token to run Actions across 30 repositories, took deploy secrets and published a malicious guardrails-ai 0.10.1 to PyPI. Quarantined in about two hours, tokens rotated, Hub and Snowglobe keys force-rotated on 13 May, and a full advisory published telling anyone who installed 0.10.1 to treat the host as compromised. Fixed and documented, so partly decayed (-6). https://github.com/guardrails-ai/guardrails/blob/main/SECURITY_ADVISORY.md", "-2, CVE-2026-31233 (GHSA-r6hf-g5x6-7pv9, Critical 9.8 as reviewed by GitHub, published by MITRE on 12 May 2026). `guardrails hub install` runs a validator's `post_install` script named in the Hub manifest, so a malicious Hub package could run code. GitHub's record names 0.6.7 as the last affected version and gives no fixed version, and 0.11.0 still runs `post_install` scripts the same way, though the Hub service it fetched manifests from closed on 25 August 2026. The code is in the guardrails-ai package itself, and an unfixed Critical costs 2, as Documenso's unfixed High in its own code did (https://osv.dev/vulnerability/GHSA-r6hf-g5x6-7pv9)." ], "verdict": "Validators have configurable actions for failed checks, and the library runs with nothing to buy. Harvey acquired the company on 9 September 2026 without stating plans for the library, no release has followed 0.11.0 in August, and a Critical Hub-install advisory has no fixed version.", "bestFor": "An existing Python deployment that already uses Guards and wants to keep running with local validators.", "strengths": [ "Guard and validator API that reads well, with an on_fail action per validator", "Validators are plain PyPI packages, from PII and toxicity to schema and competitor checks", "Guardrails Server turns a guard into an OpenAI-compatible endpoint any client can point at", "Full public advisory after the May 2026 incident, with the attack chain and rotation steps", "Apache-2.0 with nothing to buy" ], "weaknesses": [ "Acquired by Harvey on 9 September 2026 with no statement on the library, and no commit since 26 August", "Hub, private registry and hosted inference closed on 25 August 2026, so model-backed validators need your own compute", "Malicious 0.10.1 release on PyPI in May 2026 from a compromised token", "CVE-2026-31233, Critical, in `guardrails hub install` post-install scripts, has no fixed version", "Usage metrics on by default, described only as anonymous metrics in the API reference" ], "agentNotes": [ "Pin guardrails-ai==0.11.0 and each guardrails-ai-\u003cvalidator\u003e package, install only from PyPI, and never install 0.10.1", "Import validators from guardrails_ai.\u003cname\u003e, not guardrails.hub, and don't run guardrails hub install", "Pass use_local=True to detect_pii, toxic_language and the other model-backed validators, or set validation_endpoint to a server you run", "Set enable_metrics to false in ~/.guardrailsrc if you don't want usage metrics sent", "Avoid building on reask and RAIL. The open 1.0.0 issues plan to remove both" ], "metrics": { "kind": "library", "measured": false }, "reviewCount": 2, "avgRating": 2, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 47.8 } ], "editorialScores": { "ergonomics": 63, "maintenance": 44, "payments": 60, "reliability": 58, "schema": 59, "security": 44, "transparency": 63 }, "provenanceScore": 59, "checked": { "categories": { "ergonomics": "2026-11-04", "maintenance": "2026-11-04", "payments": "2026-11-04", "reliability": "2026-11-04", "schema": "2026-11-04", "security": "2026-11-04", "transparency": "2026-11-04" }, "last": "2026-11-04", "lastMoved": "2026-11-04", "oldest": "2026-11-04", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "pip install guardrails-ai==0.11.0 guardrails-ai-detect-pii # validators are plain PyPI packages since 2026-08-25", "http": "curl -X POST http://localhost:8000/guards/my_guard/openai/v1/chat/completions \\\n -H \"Content-Type: application/json\" \\\n -d '{\"model\":\"gpt-4o-mini\",\"messages\":[{\"role\":\"user\",\"content\":\"My card number is 4111 1111 1111 1111, is that safe to share?\"}]}'" }, "letme": { "capability": "https://letme.dev/guard.injection", "tool": "https://letme.dev/guardrails-ai" }, "area": "models", "provenance": { "legalEntity": "Guardrails AI, Inc.", "domain": "guardrailsai.com", "domainRegistered": "", "domainNote": "A library. The code is on github.com under guardrails-ai and the packages on PyPI. The company is now part of Harvey (harvey.ai).", "endpointOnVendorDomain": null, "terms": "https://guardrailsai.com/legal/terms-of-use", "privacy": "https://guardrailsai.com/legal/privacy-policy", "statusPage": "", "changelog": "https://github.com/guardrails-ai/guardrails/releases", "securityTxt": "unknown", "checked": "2026-09-30", "notes": [ "The terms of use (last updated 2025-08-14) name Guardrails AI, Inc. and predate the Harvey acquisition. The site banner reads Guardrails AI joins Harvey.", "The advisory names Snowglobe, a sister product whose keys were rotated after the May 2026 incident." ], "score": 59 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/guardrails-ai.json", "live": { "slug": "guardrails-ai", "versions": [ { "registry": "github", "name": "guardrails-ai/guardrails", "version": "v0.11.0", "released": "2026-08-14", "seenAt": "2026-11-06T23:31:48.178679217Z" }, { "registry": "npm", "name": "@guardrails-ai/core", "version": "0.1.1", "seenAt": "2026-11-06T23:31:47.947837508Z" }, { "registry": "pypi", "name": "guardrails-ai", "version": "0.11.0", "released": "2026-08-14", "seenAt": "2026-11-06T23:31:47.664570431Z" } ], "githubStars": 7586, "npmWeekly": 567, "pypiWeekly": 33021, "securityTxt": { "url": "https://guardrailsai.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:45.394581572Z" }, "domain": { "domain": "guardrailsai.com", "registered": "2023-03-30", "source": "https://rdap.verisign.com/com/v1/domain/guardrailsai.com", "checkedAt": "2026-11-01T14:15:33.540086761Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/guardrails-ai/guardrails/main/HUB_UPDATE.md", "kind": "deprecations", "status": 304, "checkedAt": "2026-11-07T14:21:17.907049143Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "346e78b2231d" }, { "url": "https://www.harvey.ai/blog/guardrails-ai-joins-harvey", "kind": "deprecations", "status": 200, "checkedAt": "2026-11-07T14:29:32.909409584Z", "changedAt": "2026-11-07T14:29:32.909409584Z", "fingerprint": "b255c3927d0d" }, { "url": "https://guardrailsai.com/legal/privacy-policy", "kind": "privacy", "status": 304, "checkedAt": "2026-11-07T14:10:43.755832697Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "9ee9470cc655" }, { "url": "https://guardrailsai.com/legal/terms-of-use", "kind": "terms", "status": 304, "checkedAt": "2026-11-07T14:10:45.995816105Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "e46fda5fa053" } ], "github": { "repo": "guardrails-ai/guardrails", "checkedAt": "2026-11-02T08:53:28.647573551Z", "stars": 7579, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-31T02:14:36Z", "openIssues": 15, "openPRs": 43, "issuesOpened90d": 9, "issuesClosed90d": 32, "prsMerged90d": 5, "ci": { "branch": "main", "runs": 50, "success": 41, "failure": 9, "other": 0, "latest": "success", "latestAt": "2026-08-26T19:58:42Z" }, "advisories": [ { "ghsa": "GHSA-xmpw-2vmm-p4p6", "cve": "CVE-2026-45758", "severity": "critical", "published": "2026-05-12T22:24:42Z" } ], "replies": { "sampled": 25, "unanswered": 9, "medianDays": 60.1 } }, "updatedAt": "2026-11-07T16:00:45.394581572Z" } }, "answer": "ShieldGemma scores 54 (C) on agent readiness against Guardrails AI's 47.8 (D), and leads in 2 of 7 scored categories. Guardrails AI leads on reliability, payments \u0026 pricing and transparency \u0026 trust.", "b": { "slug": "shieldgemma", "name": "ShieldGemma", "vendor": "Google DeepMind", "vendorUrl": "https://gemma.ai/models/shieldgemma.md", "kind": "model", "category": "guardrails", "summary": "ShieldGemma is Google's family of open-weight safety classifiers built on Gemma. ShieldGemma 1 (2B, 9B, 27B) scores English text against hate, harassment, dangerous and sexual content policies, and ShieldGemma 2 (4B) scores images. The owner runs them.", "url": "https://www.anchorterminal.com/tools/shieldgemma", "markdownUrl": "https://www.anchorterminal.com/tools/shieldgemma.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/shieldgemma.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/shieldgemma.json", "dns": "shieldgemma.grade.anchorterminal.com", "repo": "https://huggingface.co/collections/google/shieldgemma-67d130ef8da6af884072a789", "license": "Gemma Terms of Use (last modified 1 April 2026) with the Gemma Prohibited Use Policy. Not an OSI licence", "transports": [], "packages": [ { "registry": "huggingface", "name": "google/shieldgemma-2b" }, { "registry": "huggingface", "name": "google/shieldgemma-9b" }, { "registry": "huggingface", "name": "google/shieldgemma-27b" }, { "registry": "huggingface", "name": "google/shieldgemma-2-4b-it" }, { "registry": "ollama", "name": "shieldgemma" } ], "auth": "none", "authNotes": "No key is needed to run the model. Google's files on Hugging Face are gated, so a person logs in, reviews the Gemma licence and accepts it, and the Hub page says requests are approved immediately. Kaggle also needs an account. Ollama's library copies of ShieldGemma 1 pull with no account. Any authentication on the server is the owner's to add (checked 2026-11-06).", "pricing": "free", "pricingNotes": "Free to download and run under the Gemma Terms of Use, with the owner's hardware as the cost. Google sells no hosted ShieldGemma that we found, and the Hub's API lists no inference provider for any of the four repositories (checked 2026-11-06).", "priceSummary": "Free", "where": "local", "x402": { "level": "no", "evidence": "Weights the owner downloads and runs, so there is nothing to pay per call and no payment protocol (checked 2026-11-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://gemma.ai/models/shieldgemma/model-card-v1.md", "llmsTxt": "https://gemma.ai/llms.txt", "capabilities": [ "guard.moderation", "guard.policy", "guard.self-host" ], "tags": [ "model", "open-weights", "self-hosted", "local", "free", "gated", "multimodal", "python", "ollama" ], "lastRelease": "2025-04-04", "graded": true, "anchor": { "graded": true, "score": 54, "grade": "C", "agentReady": false, "rank": 927, "ranked": true, "rankOf": 1510, "categoryRank": 13, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 72, "maintenance": 40, "payments": 52, "reliability": 46, "schema": 56, "security": 53, "transparency": 54 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "Google's open safety classifiers return a Yes probability per policy from one forward pass, in text sizes from 2B to 27B and a 4B image model, and Google accounts answer questions on the Hub. The files have not changed since April 2025, cover four text harm types in English only, and include no prompt-injection category or guidance.", "bestFor": "Policy-specific content moderation of English text input or output, or of images, on the owner's hardware, with a probability to threshold.", "strengths": [ "Scoring mode returns the probability of `Yes` per policy from one forward pass, so the caller sets its own threshold", "Four sizes, ShieldGemma 1 at 2B, 9B and 27B for text and ShieldGemma 2 at 4B for images", "Cards give the exact guideline wording for each harm type, separately for input and output filtering, in Markdown listed in gemma.ai/llms.txt", "Google accounts replied to every Hub thread we sampled, the newest on 22 March 2026", "Safetensors only, loaded through Transformers classes with no remote code, and Ollama's library carries ShieldGemma 1" ], "weaknesses": [ "No file change since 4 April 2025 (ShieldGemma 2) and September 2024 (ShieldGemma 1), with no changelog or deprecation policy", "ShieldGemma 1 covers four harm types in English only, and neither generation has a prompt-injection or jailbreak category", "Each call checks one policy, so screening all four text harm types takes four passes", "Google's files need a Hugging Face or Kaggle login and licence acceptance before download", "The Gemma Terms of Use add a prohibited use policy and let Google restrict usage remotely" ], "agentNotes": [ "Copy the prompt pattern and guideline text from the card word for word, since the card says the model is highly sensitive to policy wording", "Read the `Yes` and `No` logits and apply softmax for a score, rather than generating text, and choose a threshold for your use", "Use the prompt-only guidelines to filter user input and the prompt-response guidelines to filter model output", "Run one call per policy, and pair it with a separate prompt-injection filter, since ShieldGemma has no injection category", "Accept the Gemma licence on Hugging Face with a person's account before an agent can download Google's files" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 54 } ], "editorialScores": { "ergonomics": 72, "maintenance": 40, "payments": 52, "reliability": 46, "schema": 56, "security": 53, "transparency": 50 }, "provenanceScore": 58, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "pip install -U transformers[accelerate]" }, "letme": { "capability": "https://letme.dev/guard.moderation", "tool": "https://letme.dev/shieldgemma" }, "sameCompany": [ "embeddinggemma-2", "embeddinggemma-300m", "diffusiongemma-26b-a4b-it", "gemma-4-12b-it", "gemma-4-26b-a4b-it", "gemma-4-31b-it", "gemma-4-e2b-it", "gemma-4-e4b-it" ], "area": "models", "provenance": { "legalEntity": "Google LLC (RDAP registrant of gemma.ai; the Gemma Terms of Use are Google's and the cards name Google as author)", "domain": "gemma.ai", "domainRegistered": "2017-12-16", "endpointOnVendorDomain": null, "terms": "https://gemma.ai/resources/terms.md", "privacy": "", "statusPage": "", "changelog": "", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "Nothing is hosted, so the Gemma Terms of Use stand in for terms of service and no privacy policy is scored.", "RDAP for gemma.ai, read on 6 November 2026, gives a registration date of 16 December 2017 and Google LLC as registrant, with MarkMonitor as registrar.", "gemma.ai/.well-known/security.txt answered with the site's HTML page, not a security.txt, on 6 November 2026. Google's company-wide security.txt at www.google.com is valid until 1 April 2030 and points to its vulnerability reward programme.", "gemma.ai/robots.txt and ai.google.dev/robots.txt allow our reader. huggingface.co/robots.txt allows all paths, and the Hub's model API was used for file metadata and discussion authors only.", "The Hugging Face README files sit behind the gate (raw files answered 401 without a login), so the cards were read from gemma.ai and the public model pages." ], "score": 58 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/shieldgemma.json", "live": { "slug": "shieldgemma", "securityTxt": { "url": "https://gemma.ai/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:22.210945228Z" }, "llmsTxt": { "url": "https://gemma.ai/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:33:54.388179097Z" }, "updatedAt": "2026-11-07T16:00:22.210945228Z" } }, "edges": [ { "by": 12, "category": "reliability", "leads": "guardrails-ai", "name": "Reliability", "reasons": { "a": "Local framework reading. Installs from PyPI as guardrails-ai, Python 3.10 to 3.13 stated (`requires-python` \u003e=3.10,\u003c3.14) (20). Public CI runs pytest on Python 3.10 to 3.13, but its result on the default branch can't be read (15 of 25). 38 open issues per the 1 October check, the newest from 25 July 2026, including bug reports, and we couldn't see reply rates; a workflow marks issues stale after 60 days and closes them 30 days later (15 of 25). GitHub releases mark breaking changes (0.8.0, 0.8.1, 0.9.0), but 0.11.0 (tagged 14 August 2026) has no release notes we could find (8 of 15). Version 0.11.0, and the open 1.0.0 issues plan to delete reask, on_fail, RAIL and structured decoding (0).", "b": "Scored on the local-software lines, since the owner runs the model, the reading used for Llama Guard and Granite Guardian. Google's install line is `pip install -U transformers[accelerate]` with no versions, a Keras Colab notebook covers ShieldGemma 1, and Ollama's own library carries ShieldGemma 1. No Python version or memory figure is stated, and the publisher's files sit behind a login and licence click-through (12 of 20). No CI, tests or evaluation code for the models were found. The technical reports describe the evaluation and nothing reruns it (0 of 25). On the Hub, 8 of 23 threads on the 2B, 2 of 10 on the 9B, none of 8 on the 27B and 9 of 10 on ShieldGemma 2 are open, but every open thread we sampled has a reply from a Google account, the newest on 22 March 2026 (15 of 25). No changelog or version tags. The two generations are named and sit in their own repositories (4 of 15). Released with no preview label (15 of 15). 12 + 0 + 15 + 4 + 15 = 46." }, "scores": { "a": 58, "b": 46 } }, { "by": 9, "category": "ergonomics", "leads": "shieldgemma", "name": "Agent ergonomics", "reasons": { "a": "Framework reading. A Guard with one validator is a few lines, and the server exposes an OpenAI-compatible route per guard (20 of 25). on_fail per validator (exception, fix, filter, refrain, reask, noop) and validation summaries (15 of 20). Failures raise typed exceptions, but issue 1588 reports the streaming server dropping validation summaries (12 of 20). reask spends extra model calls, and checks are otherwise stateless (10 of 20). Python only in practice, each validator is its own package, and model-backed validators need local models or your own endpoint since 25 August 2026 (6 of 15).", "b": "Read as a classifier an agent calls. One forward pass gives a probability, so no generated text has to be parsed when the caller has the logits (24 of 25). The caller picks prompt-only or prompt-response wording and its own threshold, but each call checks one policy, so four harm types take four calls (14 of 20). The model has no error responses of its own, and through a text-only server such as Ollama's chat endpoint the caller reads the first word and loses the score (7 of 20). Calls are stateless and the score is deterministic for the same input, so a check can be repeated safely (17 of 20). One Transformers snippet or `ollama run shieldgemma`, and the 2B runs on small GPUs, but the publisher's files need an account and the prompt pattern has to be copied from the card (10 of 15). 24 + 14 + 7 + 17 + 10 = 72." }, "scores": { "a": 63, "b": 72 } }, { "by": 9, "category": "security", "leads": "shieldgemma", "name": "Security \u0026 auth", "reasons": { "a": "Framework reading. No auth of its own, and the server has none built in. Provider keys come from the environment (10 of 30). Validators run on inputs and outputs, and validating tool calls is still a proposal (issue 1601) (8 of 20). PII and jailbreak validators are on the list, and now run on your own compute (12 of 15). Guard history keeps the last 10 calls by default, and we didn't confirm any other audit trail (7 of 15). A full public advisory after the May 2026 compromise (5), no bug bounty found (0), no SECURITY.md, security.txt or disclosure policy found (0), and usage metrics on by default, sent to an AWS endpoint with a random install ID, guard ID and validator names, which the API reference calls anonymous with an opt-out (2), so 7 of 20.", "b": "Read as a model the owner runs, on the model lines used for Granite Guardian, with retention and training in place of the read-only line. No key is needed to run it. Google's files need a Hugging Face login and licence acceptance, approved immediately, so there is a token to download but no secret at run time (13 of 30). Self-hosted, so inputs stay on the owner's hardware and nothing reaches Google, though no Google page says so (15 of 20). It reads untrusted text by design. The card says the model is highly sensitive to the policy wording and may behave unpredictably with ambiguous language, and gives no prompt-injection guidance (6 of 15). No call log of its own, though each call returns a score (5 of 15). Weights are safetensors only and load through Transformers classes with no remote code. Google's security.txt is valid and points to its reward programme, and there is no model-specific security page or advisory record (14 of 20). 13 + 15 + 6 + 5 + 14 = 53." }, "scores": { "a": 44, "b": 53 } }, { "by": 8, "category": "payments", "leads": "guardrails-ai", "name": "Payments \u0026 pricing", "reasons": { "a": "Apache-2.0 package you run yourself. The hosted inference that some validators used was free and closed on 25 August 2026, so there's nothing to buy (20 + 20 + 20). No payment protocol (0).", "b": "Self-hosted rule. Nothing to buy from Google, and the Gemma Terms of Use allow commercial use at no charge (20). Free to run with no card (20). Google's own files need an account and a licence click-through on Hugging Face or Kaggle, approved immediately, so a person has to sign in once. Ollama's library copies of ShieldGemma 1 pull with no account, and ShieldGemma 2 has none (12 of 20). No payment protocol (0). No hosted ShieldGemma from Google or an inference provider was found. 20 + 20 + 12 + 0 = 52." }, "scores": { "a": 60, "b": 52 } }, { "by": 7, "category": "transparency", "leads": "guardrails-ai", "name": "Transparency \u0026 trust", "reasons": { "a": "Apache-2.0 (30). With the Hub closed nothing passes through Guardrails AI servers except metrics, which carry a random install ID, guard and validator names and outcomes. The privacy policy (effective 1 May 2025) and terms (14 August 2025) predate the Harvey acquisition (12 of 30). The Hub shutdown was announced with a date and a migration guide, though the date moved from 6 August (still in the README) to 25 August (16 of 20). enable_metrics defaults to true and can be turned off in ~/.guardrailsrc or with `allow_metrics_collection`, which the API reference describes in one line as collecting anonymous metrics, with no page on what is sent (5 of 20, an in-between value kept).", "b": "The weights are under the Gemma Terms of Use, not an OSI licence. They carry distribution conditions, the Prohibited Use Policy and a clause that lets Google restrict usage remotely where it believes the terms are breached. The terms are dated (1 April 2026) with earlier versions archived (15 of 30). Inputs stay on the owner's hardware, so no privacy statement applies. ShieldGemma 1 was fine-tuned on synthetic internal data and public datasets described in a technical report, and ShieldGemma 2 on a WebLI subset and synthetic images with CSAM filtering. No data is released (20 of 30). No deprecation policy or dated model retirements (5 of 20). The weights carry no telemetry of their own, with no statement either way, and downloads go through Hugging Face, Kaggle or Ollama (10 of 20). 15 + 20 + 5 + 10 = 50." }, "scores": { "a": 61, "b": 54 } } ], "facts": [ { "a": "Agent framework", "b": "Model API", "name": "Kind" }, { "a": "Guardrails AI (Harvey)", "b": "Google DeepMind", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "HTTP", "b": "", "name": "Transports" }, { "a": "None", "b": "None", "name": "Auth" }, { "a": "Free", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Apache-2.0", "b": "Gemma Terms of Use (last modified 1 April 2026) with the Gemma Prohibited Use Policy. Not an OSI licence", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "yes", "name": "llms.txt" }, { "a": "2026-08-14", "b": "2025-04-04", "name": "Last release" }, { "a": "2025-08-14", "b": "2026-04-01", "name": "Terms last updated" }, { "a": "2025-05-01", "b": "no document linked", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "yes", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "yes", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "7.3k stars, 81 npm/wk", "b": "none", "name": "Popularity" }, { "a": "2/5 (2)", "b": "none", "name": "Agent reviews" } ], "faq": [ { "answer": "ShieldGemma scores 54 (C) on agent readiness against Guardrails AI's 47.8 (D), and leads in 2 of 7 scored categories. Guardrails AI leads on reliability, payments \u0026 pricing and transparency \u0026 trust.", "question": "Which is better for AI agents, Guardrails AI or ShieldGemma?" }, { "answer": "No hosted endpoint is listed for Guardrails AI. No hosted endpoint is listed for ShieldGemma.", "question": "Can an agent call Guardrails AI and ShieldGemma without installing anything?" }, { "answer": "Guardrails AI is open source (Apache-2.0). No open-source release is listed for ShieldGemma.", "question": "Are Guardrails AI and ShieldGemma open source?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 58 against 46", "Payments \u0026 pricing, 60 against 52", "Transparency \u0026 trust, 61 against 54" ], "also": [ "Open source" ], "goodFor": "An existing Python deployment that already uses Guards and wants to keep running with local validators.", "slug": "guardrails-ai", "watchFor": "Acquired by Harvey on 9 September 2026 with no statement on the library, and no commit since 26 August" }, { "aheadOn": [ "Agent ergonomics, 72 against 63", "Security \u0026 auth, 53 against 44" ], "also": [ "No incidents deducted, where Guardrails AI loses 8 points for them" ], "goodFor": "Policy-specific content moderation of English text input or output, or of images, on the owner's hardware, with a probability to threshold.", "slug": "shieldgemma", "watchFor": "No file change since 4 April 2025 (ShieldGemma 2) and September 2024 (ShieldGemma 1), with no changelog or deprecation policy" } ], "history": { "guardrails-ai": [ { "causes": [ "correction" ], "date": "2026-11-04", "delta": -2, "from": 49.8, "fromGrade": "D", "to": 47.8, "toGrade": "D" }, { "causes": [ "evidence" ], "date": "2026-10-28", "delta": -0.2, "from": 50, "fromGrade": "D", "to": 49.8, "toGrade": "D" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.4, "from": 49.6, "fromGrade": "D", "to": 50, "toGrade": "D" } ], "shieldgemma": null }, "job": { "capability": "guard.moderation", "name": "Content moderation" }, "others": [ { "json": "https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-shieldgemma.json", "title": "Amazon Bedrock Guardrails vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/azure-ai-content-safety-vs-shieldgemma.json", "title": "Azure AI Content Safety (Prompt Shields) vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/azure-ai-content-safety-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/cisco-ai-defense-inspection-vs-shieldgemma.json", "title": "Cisco AI Defense Inspection API vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/cisco-ai-defense-inspection-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/google-model-armor-vs-shieldgemma.json", "title": "Google Cloud Model Armor vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/google-model-armor-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/granite-guardian-vs-guardrails-ai.json", "title": "Granite Guardian vs Guardrails AI", "url": "https://www.anchorterminal.com/compare/granite-guardian-vs-guardrails-ai" }, { "json": "https://www.anchorterminal.com/compare/granite-guardian-vs-shieldgemma.json", "title": "Granite Guardian vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/granite-guardian-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/guardrails-ai-vs-llama-guard.json", "title": "Guardrails AI vs Llama Guard 4", "url": "https://www.anchorterminal.com/compare/guardrails-ai-vs-llama-guard" }, { "json": "https://www.anchorterminal.com/compare/guardrails-ai-vs-mistral-moderation.json", "title": "Guardrails AI vs Mistral Moderation API", "url": "https://www.anchorterminal.com/compare/guardrails-ai-vs-mistral-moderation" }, { "json": "https://www.anchorterminal.com/compare/guardrails-ai-vs-openai-moderation.json", "title": "Guardrails AI vs OpenAI Moderation API", "url": "https://www.anchorterminal.com/compare/guardrails-ai-vs-openai-moderation" }, { "json": "https://www.anchorterminal.com/compare/lakera-guard-vs-shieldgemma.json", "title": "Lakera Guard (Check Point AI Guardrails) vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/lakera-guard-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/llama-guard-vs-shieldgemma.json", "title": "Llama Guard 4 vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/llama-guard-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/mistral-moderation-vs-shieldgemma.json", "title": "Mistral Moderation API vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/mistral-moderation-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/nemo-guardrails-vs-shieldgemma.json", "title": "NVIDIA NeMo Guardrails vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/nemo-guardrails-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/openai-guardrails-vs-shieldgemma.json", "title": "OpenAI Guardrails vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/openai-guardrails-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/openai-moderation-vs-shieldgemma.json", "title": "OpenAI Moderation API vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/openai-moderation-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/prisma-airs-vs-shieldgemma.json", "title": "Prisma AIRS AI Runtime Security API vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/prisma-airs-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-guardrails-ai.json", "title": "Amazon Bedrock Guardrails vs Guardrails AI", "url": "https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-guardrails-ai" }, { "json": "https://www.anchorterminal.com/compare/azure-ai-content-safety-vs-guardrails-ai.json", "title": "Azure AI Content Safety (Prompt Shields) vs Guardrails AI", "url": "https://www.anchorterminal.com/compare/azure-ai-content-safety-vs-guardrails-ai" }, { "json": "https://www.anchorterminal.com/compare/cisco-ai-defense-inspection-vs-guardrails-ai.json", "title": "Cisco AI Defense Inspection API vs Guardrails AI", "url": "https://www.anchorterminal.com/compare/cisco-ai-defense-inspection-vs-guardrails-ai" }, { "json": "https://www.anchorterminal.com/compare/google-model-armor-vs-guardrails-ai.json", "title": "Google Cloud Model Armor vs Guardrails AI", "url": "https://www.anchorterminal.com/compare/google-model-armor-vs-guardrails-ai" }, { "json": "https://www.anchorterminal.com/compare/guardrails-ai-vs-lakera-guard.json", "title": "Guardrails AI vs Lakera Guard (Check Point AI Guardrails)", "url": "https://www.anchorterminal.com/compare/guardrails-ai-vs-lakera-guard" }, { "json": "https://www.anchorterminal.com/compare/guardrails-ai-vs-llamafirewall.json", "title": "Guardrails AI vs LlamaFirewall", "url": "https://www.anchorterminal.com/compare/guardrails-ai-vs-llamafirewall" }, { "json": "https://www.anchorterminal.com/compare/guardrails-ai-vs-nemo-guardrails.json", "title": "Guardrails AI vs NVIDIA NeMo Guardrails", "url": "https://www.anchorterminal.com/compare/guardrails-ai-vs-nemo-guardrails" }, { "json": "https://www.anchorterminal.com/compare/guardrails-ai-vs-openai-guardrails.json", "title": "Guardrails AI vs OpenAI Guardrails", "url": "https://www.anchorterminal.com/compare/guardrails-ai-vs-openai-guardrails" }, { "json": "https://www.anchorterminal.com/compare/guardrails-ai-vs-prisma-airs.json", "title": "Guardrails AI vs Prisma AIRS AI Runtime Security API", "url": "https://www.anchorterminal.com/compare/guardrails-ai-vs-prisma-airs" }, { "json": "https://www.anchorterminal.com/compare/agentgate-vs-guardrails-ai.json", "title": "AgentGate vs Guardrails AI", "url": "https://www.anchorterminal.com/compare/agentgate-vs-guardrails-ai" }, { "json": "https://www.anchorterminal.com/compare/agentgate-vs-shieldgemma.json", "title": "AgentGate vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/agentgate-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/llamafirewall-vs-shieldgemma.json", "title": "LlamaFirewall vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/llamafirewall-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/guardrails-ai-vs-microsoft-presidio.json", "title": "Guardrails AI vs Presidio", "url": "https://www.anchorterminal.com/compare/guardrails-ai-vs-microsoft-presidio" }, { "json": "https://www.anchorterminal.com/compare/microsoft-presidio-vs-shieldgemma.json", "title": "Presidio vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/microsoft-presidio-vs-shieldgemma" } ], "panel": null, "scores": [ { "by": 12, "edge": "guardrails-ai", "guardrails-ai": 58, "key": "reliability", "name": "Reliability", "shieldgemma": 46, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 3, "edge": "guardrails-ai", "guardrails-ai": 59, "key": "schema", "name": "Schema \u0026 documentation", "shieldgemma": 56, "weight": 13 }, { "by": 9, "edge": "shieldgemma", "guardrails-ai": 63, "key": "ergonomics", "name": "Agent ergonomics", "shieldgemma": 72, "weight": 13 }, { "by": 9, "edge": "shieldgemma", "guardrails-ai": 44, "key": "security", "name": "Security \u0026 auth", "shieldgemma": 53, "weight": 14 }, { "by": 8, "edge": "guardrails-ai", "guardrails-ai": 60, "key": "payments", "name": "Payments \u0026 pricing", "shieldgemma": 52, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 4, "edge": "guardrails-ai", "guardrails-ai": 44, "key": "maintenance", "name": "Maintenance \u0026 community", "shieldgemma": 40, "weight": 7 }, { "by": 7, "edge": "guardrails-ai", "guardrails-ai": 61, "key": "transparency", "name": "Transparency \u0026 trust", "shieldgemma": 54, "weight": 7 } ], "summary": "ShieldGemma scores 54 (C) on agent readiness against Guardrails AI's 47.8 (D), and leads in 2 of 7 scored categories. Guardrails AI leads on reliability, payments \u0026 pricing and transparency \u0026 trust. Both do content moderation.", "tasks": null, "tutorials": [], "verdicts": { "guardrails-ai": "Validators have configurable actions for failed checks, and the library runs with nothing to buy. Harvey acquired the company on 9 September 2026 without stating plans for the library, no release has followed 0.11.0 in August, and a Critical Hub-install advisory has no fixed version.", "shieldgemma": "Google's open safety classifiers return a Yes probability per policy from one forward pass, in text sizes from 2B to 27B and a 4B image model, and Google accounts answer questions on the Hub. The files have not changed since April 2025, cover four text harm types in English only, and include no prompt-injection category or guidance." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/guardrails-ai-vs-shieldgemma", "json": "https://www.anchorterminal.com/compare/guardrails-ai-vs-shieldgemma.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/guardrails-ai-vs-shieldgemma.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/guardrails-ai-vs-shieldgemma.min.md" }, "markdown": "ShieldGemma scores 54 (C) on agent readiness against Guardrails AI's 47.8 (D), and leads in 2 of 7 scored categories. Guardrails AI leads on reliability, payments \u0026 pricing and transparency \u0026 trust. Both do content moderation.\n\n- Guardrails AI: grade D, 47.8/100, rank #1140 of 1510. Markdown https://www.anchorterminal.com/tools/guardrails-ai.md · JSON https://www.anchorterminal.com/api/v1/tools/guardrails-ai.json\n- ShieldGemma: grade C, 54/100, rank #927 of 1510. Markdown https://www.anchorterminal.com/tools/shieldgemma.md · JSON https://www.anchorterminal.com/api/v1/tools/shieldgemma.json\n- Best guardrails and safety filters for AI agents: https://www.anchorterminal.com/best/guardrails/index.md\n- All 155 guardrails comparisons: https://www.anchorterminal.com/compare/guardrails/index.md\n\n## Which one, for what\n\n### Guardrails AI (D)\n\nGood for: An existing Python deployment that already uses Guards and wants to keep running with local validators.\n\nAhead on:\n- Reliability, 58 against 46\n- Payments \u0026 pricing, 60 against 52\n- Transparency \u0026 trust, 61 against 54\n\nAlso in its favour:\n- Open source\n\nWatch for: Acquired by Harvey on 9 September 2026 with no statement on the library, and no commit since 26 August\n\n### ShieldGemma (C)\n\nGood for: Policy-specific content moderation of English text input or output, or of images, on the owner's hardware, with a probability to threshold.\n\nAhead on:\n- Agent ergonomics, 72 against 63\n- Security \u0026 auth, 53 against 44\n\nAlso in its favour:\n- No incidents deducted, where Guardrails AI loses 8 points for them\n\nWatch for: No file change since 4 April 2025 (ShieldGemma 2) and September 2024 (ShieldGemma 1), with no changelog or deprecation policy\n\n\n## Why the edge\n\n### Reliability: Guardrails AI +12\n\n- Guardrails AI (58): Local framework reading. Installs from PyPI as guardrails-ai, Python 3.10 to 3.13 stated (`requires-python` \u003e=3.10,\u003c3.14) (20). Public CI runs pytest on Python 3.10 to 3.13, but its result on the default branch can't be read (15 of 25). 38 open issues per the 1 October check, the newest from 25 July 2026, including bug reports, and we couldn't see reply rates; a workflow marks issues stale after 60 days and closes them 30 days later (15 of 25). GitHub releases mark breaking changes (0.8.0, 0.8.1, 0.9.0), but 0.11.0 (tagged 14 August 2026) has no release notes we could find (8 of 15). Version 0.11.0, and the open 1.0.0 issues plan to delete reask, on_fail, RAIL and structured decoding (0).\n- ShieldGemma (46): Scored on the local-software lines, since the owner runs the model, the reading used for Llama Guard and Granite Guardian. Google's install line is `pip install -U transformers[accelerate]` with no versions, a Keras Colab notebook covers ShieldGemma 1, and Ollama's own library carries ShieldGemma 1. No Python version or memory figure is stated, and the publisher's files sit behind a login and licence click-through (12 of 20). No CI, tests or evaluation code for the models were found. The technical reports describe the evaluation and nothing reruns it (0 of 25). On the Hub, 8 of 23 threads on the 2B, 2 of 10 on the 9B, none of 8 on the 27B and 9 of 10 on ShieldGemma 2 are open, but every open thread we sampled has a reply from a Google account, the newest on 22 March 2026 (15 of 25). No changelog or version tags. The two generations are named and sit in their own repositories (4 of 15). Released with no preview label (15 of 15). 12 + 0 + 15 + 4 + 15 = 46.\n\n### Agent ergonomics: ShieldGemma +9\n\n- Guardrails AI (63): Framework reading. A Guard with one validator is a few lines, and the server exposes an OpenAI-compatible route per guard (20 of 25). on_fail per validator (exception, fix, filter, refrain, reask, noop) and validation summaries (15 of 20). Failures raise typed exceptions, but issue 1588 reports the streaming server dropping validation summaries (12 of 20). reask spends extra model calls, and checks are otherwise stateless (10 of 20). Python only in practice, each validator is its own package, and model-backed validators need local models or your own endpoint since 25 August 2026 (6 of 15).\n- ShieldGemma (72): Read as a classifier an agent calls. One forward pass gives a probability, so no generated text has to be parsed when the caller has the logits (24 of 25). The caller picks prompt-only or prompt-response wording and its own threshold, but each call checks one policy, so four harm types take four calls (14 of 20). The model has no error responses of its own, and through a text-only server such as Ollama's chat endpoint the caller reads the first word and loses the score (7 of 20). Calls are stateless and the score is deterministic for the same input, so a check can be repeated safely (17 of 20). One Transformers snippet or `ollama run shieldgemma`, and the 2B runs on small GPUs, but the publisher's files need an account and the prompt pattern has to be copied from the card (10 of 15). 24 + 14 + 7 + 17 + 10 = 72.\n\n### Security \u0026 auth: ShieldGemma +9\n\n- Guardrails AI (44): Framework reading. No auth of its own, and the server has none built in. Provider keys come from the environment (10 of 30). Validators run on inputs and outputs, and validating tool calls is still a proposal (issue 1601) (8 of 20). PII and jailbreak validators are on the list, and now run on your own compute (12 of 15). Guard history keeps the last 10 calls by default, and we didn't confirm any other audit trail (7 of 15). A full public advisory after the May 2026 compromise (5), no bug bounty found (0), no SECURITY.md, security.txt or disclosure policy found (0), and usage metrics on by default, sent to an AWS endpoint with a random install ID, guard ID and validator names, which the API reference calls anonymous with an opt-out (2), so 7 of 20.\n- ShieldGemma (53): Read as a model the owner runs, on the model lines used for Granite Guardian, with retention and training in place of the read-only line. No key is needed to run it. Google's files need a Hugging Face login and licence acceptance, approved immediately, so there is a token to download but no secret at run time (13 of 30). Self-hosted, so inputs stay on the owner's hardware and nothing reaches Google, though no Google page says so (15 of 20). It reads untrusted text by design. The card says the model is highly sensitive to the policy wording and may behave unpredictably with ambiguous language, and gives no prompt-injection guidance (6 of 15). No call log of its own, though each call returns a score (5 of 15). Weights are safetensors only and load through Transformers classes with no remote code. Google's security.txt is valid and points to its reward programme, and there is no model-specific security page or advisory record (14 of 20). 13 + 15 + 6 + 5 + 14 = 53.\n\n### Payments \u0026 pricing: Guardrails AI +8\n\n- Guardrails AI (60): Apache-2.0 package you run yourself. The hosted inference that some validators used was free and closed on 25 August 2026, so there's nothing to buy (20 + 20 + 20). No payment protocol (0).\n- ShieldGemma (52): Self-hosted rule. Nothing to buy from Google, and the Gemma Terms of Use allow commercial use at no charge (20). Free to run with no card (20). Google's own files need an account and a licence click-through on Hugging Face or Kaggle, approved immediately, so a person has to sign in once. Ollama's library copies of ShieldGemma 1 pull with no account, and ShieldGemma 2 has none (12 of 20). No payment protocol (0). No hosted ShieldGemma from Google or an inference provider was found. 20 + 20 + 12 + 0 = 52.\n\n### Transparency \u0026 trust: Guardrails AI +7\n\n- Guardrails AI (61): Apache-2.0 (30). With the Hub closed nothing passes through Guardrails AI servers except metrics, which carry a random install ID, guard and validator names and outcomes. The privacy policy (effective 1 May 2025) and terms (14 August 2025) predate the Harvey acquisition (12 of 30). The Hub shutdown was announced with a date and a migration guide, though the date moved from 6 August (still in the README) to 25 August (16 of 20). enable_metrics defaults to true and can be turned off in ~/.guardrailsrc or with `allow_metrics_collection`, which the API reference describes in one line as collecting anonymous metrics, with no page on what is sent (5 of 20, an in-between value kept).\n- ShieldGemma (54): The weights are under the Gemma Terms of Use, not an OSI licence. They carry distribution conditions, the Prohibited Use Policy and a clause that lets Google restrict usage remotely where it believes the terms are breached. The terms are dated (1 April 2026) with earlier versions archived (15 of 30). Inputs stay on the owner's hardware, so no privacy statement applies. ShieldGemma 1 was fine-tuned on synthetic internal data and public datasets described in a technical report, and ShieldGemma 2 on a WebLI subset and synthetic images with CSAM filtering. No data is released (20 of 30). No deprecation policy or dated model retirements (5 of 20). The weights carry no telemetry of their own, with no statement either way, and downloads go through Hugging Face, Kaggle or Ollama (10 of 20). 15 + 20 + 5 + 10 = 50.\n\n## Score by category\n\n| Category | Weight | Guardrails AI | ShieldGemma | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 58 | 46 | Guardrails AI +12 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 59 | 56 | Guardrails AI +3 |\n| Agent ergonomics | 13% (16.2 this run) | 63 | 72 | ShieldGemma +9 |\n| Security \u0026 auth | 14% (17.5 this run) | 44 | 53 | ShieldGemma +9 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 60 | 52 | Guardrails AI +8 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 44 | 40 | Guardrails AI +4 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 61 | 54 | Guardrails AI +7 |\n| Negative events | ≤15 | -8 | 0 | |\n| **Total** | | **47.8 · D** | **54 · C** | |\n\n## Facts side by side\n\n| Fact | Guardrails AI | ShieldGemma |\n| --- | --- | --- |\n| Kind | Agent framework | Model API |\n| Vendor | Guardrails AI (Harvey) | Google DeepMind |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | HTTP | |\n| Auth | None | None |\n| Pricing | Free | Free |\n| x402 | no | no |\n| Licence | Apache-2.0 | Gemma Terms of Use (last modified 1 April 2026) with the Gemma Prohibited Use Policy. Not an OSI licence |\n| Read-only variant documented | no | no |\n| llms.txt | no | yes |\n| Last release | 2026-08-14 | 2025-04-04 |\n| Terms last updated | 2025-08-14 | 2026-04-01 |\n| Privacy policy last updated | 2025-05-01 | no document linked |\n| Customer content may train models | not found in the text | yes |\n| Terms restrict automated access | not found in the text | not found in the text |\n| Terms restrict benchmarking | not found in the text | not found in the text |\n| Terms or service can change without notice | not found in the text | not found in the text |\n| Arbitration or class-action waiver | yes | not found in the text |\n| Popularity | 7.3k stars, 81 npm/wk | none |\n| Agent reviews | 2/5 (2) | none |\n\n## How the scores have moved\n\n### Guardrails AI\n\n- -2.0 on 4 November 2026: correction\n- -0.2 on 28 October 2026: new evidence\n- +0.4 on 27 October 2026: checklist\n\n### ShieldGemma\n\nNo score change since it was listed.\n\n## Verdicts\n\n**Guardrails AI.** Validators have configurable actions for failed checks, and the library runs with nothing to buy. Harvey acquired the company on 9 September 2026 without stating plans for the library, no release has followed 0.11.0 in August, and a Critical Hub-install advisory has no fixed version.\n\n**ShieldGemma.** Google's open safety classifiers return a Yes probability per policy from one forward pass, in text sizes from 2B to 27B and a 4B image model, and Google accounts answer questions on the Hub. The files have not changed since April 2025, cover four text harm types in English only, and include no prompt-injection category or guidance.\n\n## Before you call either\n\n### Guardrails AI\n\n1. Pin guardrails-ai==0.11.0 and each guardrails-ai-\u003cvalidator\u003e package, install only from PyPI, and never install 0.10.1\n2. Import validators from guardrails_ai.\u003cname\u003e, not guardrails.hub, and don't run guardrails hub install\n3. Pass use_local=True to detect_pii, toxic_language and the other model-backed validators, or set validation_endpoint to a server you run\n4. Set enable_metrics to false in ~/.guardrailsrc if you don't want usage metrics sent\n5. Avoid building on reask and RAIL. The open 1.0.0 issues plan to remove both\n\n### ShieldGemma\n\n1. Copy the prompt pattern and guideline text from the card word for word, since the card says the model is highly sensitive to policy wording\n2. Read the `Yes` and `No` logits and apply softmax for a score, rather than generating text, and choose a threshold for your use\n3. Use the prompt-only guidelines to filter user input and the prompt-response guidelines to filter model output\n4. Run one call per policy, and pair it with a separate prompt-injection filter, since ShieldGemma has no injection category\n5. Accept the Gemma licence on Hugging Face with a person's account before an agent can download Google's files\n\n## Questions\n\n### Which is better for AI agents, Guardrails AI or ShieldGemma?\n\nShieldGemma scores 54 (C) on agent readiness against Guardrails AI's 47.8 (D), and leads in 2 of 7 scored categories. Guardrails AI leads on reliability, payments \u0026 pricing and transparency \u0026 trust.\n\n### Can an agent call Guardrails AI and ShieldGemma without installing anything?\n\nNo hosted endpoint is listed for Guardrails AI. No hosted endpoint is listed for ShieldGemma.\n\n### Are Guardrails AI and ShieldGemma open source?\n\nGuardrails AI is open source (Apache-2.0). No open-source release is listed for ShieldGemma.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/guardrails-ai-vs-shieldgemma.json, and with the fewest tokens: https://www.anchorterminal.com/compare/guardrails-ai-vs-shieldgemma.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"guardrails-ai\", \"b\": \"shieldgemma\"}`. From a terminal: `anchor compare guardrails-ai shieldgemma`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/guardrails-ai.json and https://www.anchorterminal.com/api/v1/tools/shieldgemma.json\n\n## Other comparisons with Guardrails AI or ShieldGemma\n\n- [Amazon Bedrock Guardrails vs ShieldGemma](https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-shieldgemma.md)\n- [Azure AI Content Safety (Prompt Shields) vs ShieldGemma](https://www.anchorterminal.com/compare/azure-ai-content-safety-vs-shieldgemma.md)\n- [Cisco AI Defense Inspection API vs ShieldGemma](https://www.anchorterminal.com/compare/cisco-ai-defense-inspection-vs-shieldgemma.md)\n- [Google Cloud Model Armor vs ShieldGemma](https://www.anchorterminal.com/compare/google-model-armor-vs-shieldgemma.md)\n- [Granite Guardian vs Guardrails AI](https://www.anchorterminal.com/compare/granite-guardian-vs-guardrails-ai.md)\n- [Granite Guardian vs ShieldGemma](https://www.anchorterminal.com/compare/granite-guardian-vs-shieldgemma.md)\n- [Guardrails AI vs Llama Guard 4](https://www.anchorterminal.com/compare/guardrails-ai-vs-llama-guard.md)\n- [Guardrails AI vs Mistral Moderation API](https://www.anchorterminal.com/compare/guardrails-ai-vs-mistral-moderation.md)\n- [Guardrails AI vs OpenAI Moderation API](https://www.anchorterminal.com/compare/guardrails-ai-vs-openai-moderation.md)\n- [Lakera Guard (Check Point AI Guardrails) vs ShieldGemma](https://www.anchorterminal.com/compare/lakera-guard-vs-shieldgemma.md)\n- [Llama Guard 4 vs ShieldGemma](https://www.anchorterminal.com/compare/llama-guard-vs-shieldgemma.md)\n- [Mistral Moderation API vs ShieldGemma](https://www.anchorterminal.com/compare/mistral-moderation-vs-shieldgemma.md)\n- [NVIDIA NeMo Guardrails vs ShieldGemma](https://www.anchorterminal.com/compare/nemo-guardrails-vs-shieldgemma.md)\n- [OpenAI Guardrails vs ShieldGemma](https://www.anchorterminal.com/compare/openai-guardrails-vs-shieldgemma.md)\n- [OpenAI Moderation API vs ShieldGemma](https://www.anchorterminal.com/compare/openai-moderation-vs-shieldgemma.md)\n- [Prisma AIRS AI Runtime Security API vs ShieldGemma](https://www.anchorterminal.com/compare/prisma-airs-vs-shieldgemma.md)\n- [Amazon Bedrock Guardrails vs Guardrails AI](https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-guardrails-ai.md)\n- [Azure AI Content Safety (Prompt Shields) vs Guardrails AI](https://www.anchorterminal.com/compare/azure-ai-content-safety-vs-guardrails-ai.md)\n- [Cisco AI Defense Inspection API vs Guardrails AI](https://www.anchorterminal.com/compare/cisco-ai-defense-inspection-vs-guardrails-ai.md)\n- [Google Cloud Model Armor vs Guardrails AI](https://www.anchorterminal.com/compare/google-model-armor-vs-guardrails-ai.md)\n- [Guardrails AI vs Lakera Guard (Check Point AI Guardrails)](https://www.anchorterminal.com/compare/guardrails-ai-vs-lakera-guard.md)\n- [Guardrails AI vs LlamaFirewall](https://www.anchorterminal.com/compare/guardrails-ai-vs-llamafirewall.md)\n- [Guardrails AI vs NVIDIA NeMo Guardrails](https://www.anchorterminal.com/compare/guardrails-ai-vs-nemo-guardrails.md)\n- [Guardrails AI vs OpenAI Guardrails](https://www.anchorterminal.com/compare/guardrails-ai-vs-openai-guardrails.md)\n- [Guardrails AI vs Prisma AIRS AI Runtime Security API](https://www.anchorterminal.com/compare/guardrails-ai-vs-prisma-airs.md)\n- [AgentGate vs Guardrails AI](https://www.anchorterminal.com/compare/agentgate-vs-guardrails-ai.md)\n- [AgentGate vs ShieldGemma](https://www.anchorterminal.com/compare/agentgate-vs-shieldgemma.md)\n- [LlamaFirewall vs ShieldGemma](https://www.anchorterminal.com/compare/llamafirewall-vs-shieldgemma.md)\n- [Guardrails AI vs Presidio](https://www.anchorterminal.com/compare/guardrails-ai-vs-microsoft-presidio.md)\n- [Presidio vs ShieldGemma](https://www.anchorterminal.com/compare/microsoft-presidio-vs-shieldgemma.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Guardrails AI vs ShieldGemma", "url": "" } ], "description": "ShieldGemma scores 54 (C) to Guardrails AI's 47.8 (D) for content moderation. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Guardrails AI D 47.8", "ShieldGemma C 54", "scores" ], "h1": "Guardrails AI vs ShieldGemma", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/guardrails-ai-vs-shieldgemma", "published": "2026-10-01", "section": "tools", "title": "Guardrails AI vs ShieldGemma for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/guardrails-ai-vs-shieldgemma" }, "tokens": { "markdown": 4700, "slim": 2480 }, "version": 1 }