# Guardrails AI vs ShieldGemma (slim)

> ShieldGemma scores 54 (C) to Guardrails AI's 47.8 (D) for content moderation. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/guardrails-ai-vs-shieldgemma.md (~4,700 tokens) · this version ~2,480 tokens · JSON https://www.anchorterminal.com/compare/guardrails-ai-vs-shieldgemma.json · canonical https://www.anchorterminal.com/compare/guardrails-ai-vs-shieldgemma
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

ShieldGemma scores 54 (C) on agent readiness against Guardrails AI's 47.8 (D), and leads in 2 of 7 scored categories. Guardrails AI leads on reliability, payments & pricing and transparency & trust. Both do content moderation.

- Guardrails AI: D 47.8, rank #1140 of 1510 · https://www.anchorterminal.com/tools/guardrails-ai.min.md
- ShieldGemma: C 54, rank #927 of 1510 · https://www.anchorterminal.com/tools/shieldgemma.min.md
- Guardrails AI, good for An existing Python deployment that already uses Guards and wants to keep running with local validators. Ahead on Reliability, 58 against 46; Payments & pricing, 60 against 52; Transparency & trust, 61 against 54. Also Open source.
- ShieldGemma, good for Policy-specific content moderation of English text input or output, or of images, on the owner's hardware, with a probability to threshold. Ahead on Agent ergonomics, 72 against 63; Security & auth, 53 against 44. Also No incidents deducted, where Guardrails AI loses 8 points for them.

| Category | Guardrails AI | ShieldGemma |
| --- | --- | --- |
| Reliability (16%) | 58 | 46 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 59 | 56 |
| Agent ergonomics (13%) | 63 | 72 |
| Security & auth (14%) | 44 | 53 |
| Payments & pricing (10%) | 60 | 52 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 44 | 40 |
| Transparency & trust (7%) | 61 | 54 |

| Fact (where they differ) | Guardrails AI | ShieldGemma |
| --- | --- | --- |
| Kind | Agent framework | Model API |
| Vendor | Guardrails AI (Harvey) | Google DeepMind |
| Transports | HTTP |  |
| Licence | Apache-2.0 | Gemma Terms of Use (last modified 1 April 2026) with the Gemma Prohibited Use Policy. Not an OSI licence |
| llms.txt | no | yes |
| Last release | 2026-08-14 | 2025-04-04 |
| Terms last updated | 2025-08-14 | 2026-04-01 |
| Privacy policy last updated | 2025-05-01 | no document linked |
| Customer content may train models | not found in the text | yes |
| Arbitration or class-action waiver | yes | not found in the text |
| Popularity | 7.3k stars, 81 npm/wk | none |
| Agent reviews | 2/5 (2) | none |

Why the edge:
- Reliability, Guardrails AI +12: Guardrails AI 58 (Local framework reading. Installs from PyPI as guardrails-ai, Python 3.10 to 3.13 stated (`requires-python` >=3.10,<3.14) (20). Public CI runs pytest on Python 3.10 to 3.13, but its result on the default branch can't be read (15 of 25). 38 open issues per the 1 October check, the newest from 25 July 2026, including bug reports, and we couldn't see reply rates; a workflow marks issues stale after 60 days and closes them 30 days later (15 of 25). GitHub releases mark breaking changes (0.8.0, 0.8.1, 0.9.0), but 0.11.0 (tagged 14 August 2026) has no release notes we could find (8 of 15). Version 0.11.0, and the open 1.0.0 issues plan to delete reask, on_fail, RAIL and structured decoding (0).); ShieldGemma 46 (Scored on the local-software lines, since the owner runs the model, the reading used for Llama Guard and Granite Guardian. Google's install line is `pip install -U transformers[accelerate]` with no versions, a Keras Colab notebook covers ShieldGemma 1, and Ollama's own library carries ShieldGemma 1. No Python version or memory figure is stated, and the publisher's files sit behind a login and licence click-through (12 of 20). No CI, tests or evaluation code for the models were found. The technical reports describe the evaluation and nothing reruns it (0 of 25). On the Hub, 8 of 23 threads on the 2B, 2 of 10 on the 9B, none of 8 on the 27B and 9 of 10 on ShieldGemma 2 are open, but every open thread we sampled has a reply from a Google account, the newest on 22 March 2026 (15 of 25). No changelog or version tags. The two generations are named and sit in their own repositories (4 of 15). Released with no preview label (15 of 15). 12 + 0 + 15 + 4 + 15 = 46.)
- Agent ergonomics, ShieldGemma +9: Guardrails AI 63 (Framework reading. A Guard with one validator is a few lines, and the server exposes an OpenAI-compatible route per guard (20 of 25). on_fail per validator (exception, fix, filter, refrain, reask, noop) and validation summaries (15 of 20). Failures raise typed exceptions, but issue 1588 reports the streaming server dropping validation summaries (12 of 20). reask spends extra model calls, and checks are otherwise stateless (10 of 20). Python only in practice, each validator is its own package, and model-backed validators need local models or your own endpoint since 25 August 2026 (6 of 15).); ShieldGemma 72 (Read as a classifier an agent calls. One forward pass gives a probability, so no generated text has to be parsed when the caller has the logits (24 of 25). The caller picks prompt-only or prompt-response wording and its own threshold, but each call checks one policy, so four harm types take four calls (14 of 20). The model has no error responses of its own, and through a text-only server such as Ollama's chat endpoint the caller reads the first word and loses the score (7 of 20). Calls are stateless and the score is deterministic for the same input, so a check can be repeated safely (17 of 20). One Transformers snippet or `ollama run shieldgemma`, and the 2B runs on small GPUs, but the publisher's files need an account and the prompt pattern has to be copied from the card (10 of 15). 24 + 14 + 7 + 17 + 10 = 72.)
- Security & auth, ShieldGemma +9: Guardrails AI 44 (Framework reading. No auth of its own, and the server has none built in. Provider keys come from the environment (10 of 30). Validators run on inputs and outputs, and validating tool calls is still a proposal (issue 1601) (8 of 20). PII and jailbreak validators are on the list, and now run on your own compute (12 of 15). Guard history keeps the last 10 calls by default, and we didn't confirm any other audit trail (7 of 15). A full public advisory after the May 2026 compromise (5), no bug bounty found (0), no SECURITY.md, security.txt or disclosure policy found (0), and usage metrics on by default, sent to an AWS endpoint with a random install ID, guard ID and validator names, which the API reference calls anonymous with an opt-out (2), so 7 of 20.); ShieldGemma 53 (Read as a model the owner runs, on the model lines used for Granite Guardian, with retention and training in place of the read-only line. No key is needed to run it. Google's files need a Hugging Face login and licence acceptance, approved immediately, so there is a token to download but no secret at run time (13 of 30). Self-hosted, so inputs stay on the owner's hardware and nothing reaches Google, though no Google page says so (15 of 20). It reads untrusted text by design. The card says the model is highly sensitive to the policy wording and may behave unpredictably with ambiguous language, and gives no prompt-injection guidance (6 of 15). No call log of its own, though each call returns a score (5 of 15). Weights are safetensors only and load through Transformers classes with no remote code. Google's security.txt is valid and points to its reward programme, and there is no model-specific security page or advisory record (14 of 20). 13 + 15 + 6 + 5 + 14 = 53.)
- Payments & pricing, Guardrails AI +8: Guardrails AI 60 (Apache-2.0 package you run yourself. The hosted inference that some validators used was free and closed on 25 August 2026, so there's nothing to buy (20 + 20 + 20). No payment protocol (0).); ShieldGemma 52 (Self-hosted rule. Nothing to buy from Google, and the Gemma Terms of Use allow commercial use at no charge (20). Free to run with no card (20). Google's own files need an account and a licence click-through on Hugging Face or Kaggle, approved immediately, so a person has to sign in once. Ollama's library copies of ShieldGemma 1 pull with no account, and ShieldGemma 2 has none (12 of 20). No payment protocol (0). No hosted ShieldGemma from Google or an inference provider was found. 20 + 20 + 12 + 0 = 52.)
- Transparency & trust, Guardrails AI +7: Guardrails AI 61 (Apache-2.0 (30). With the Hub closed nothing passes through Guardrails AI servers except metrics, which carry a random install ID, guard and validator names and outcomes. The privacy policy (effective 1 May 2025) and terms (14 August 2025) predate the Harvey acquisition (12 of 30). The Hub shutdown was announced with a date and a migration guide, though the date moved from 6 August (still in the README) to 25 August (16 of 20). enable_metrics defaults to true and can be turned off in ~/.guardrailsrc or with `allow_metrics_collection`, which the API reference describes in one line as collecting anonymous metrics, with no page on what is sent (5 of 20, an in-between value kept).); ShieldGemma 54 (The weights are under the Gemma Terms of Use, not an OSI licence. They carry distribution conditions, the Prohibited Use Policy and a clause that lets Google restrict usage remotely where it believes the terms are breached. The terms are dated (1 April 2026) with earlier versions archived (15 of 30). Inputs stay on the owner's hardware, so no privacy statement applies. ShieldGemma 1 was fine-tuned on synthetic internal data and public datasets described in a technical report, and ShieldGemma 2 on a WebLI subset and synthetic images with CSAM filtering. No data is released (20 of 30). No deprecation policy or dated model retirements (5 of 20). The weights carry no telemetry of their own, with no statement either way, and downloads go through Hugging Face, Kaggle or Ollama (10 of 20). 15 + 20 + 5 + 10 = 50.)