OpenAI Guardrails vs ShieldGemma

OpenAI Guardrails 89

0.3.4, 0.3.5 and 0.3.6 were tagged on 26 October 2026, 6 days before the check. 0.3.4 and 0.3.6 change the package's code, while 0.3.5 only bumps a CI action (30). In the 90 days from 3 August, 0.3.2 on 21 August, 0.3.3 on 10 September and the three October releases (20). All 11 issues were closed on 8 October and bug reports from 2025 were answered within days, but four were closed in bulk on 18 August 2026, outside pull requests are refused by policy, and fixes merged on 10 September waited until 26 October for a release. Issues weren't re-read on 1 November (15 of 25). Current official packages on PyPI and npm, @openai/guardrails at 0.3.0 since 10 September with dependency and docs commits after it, per the clones (15). Dependabot, CodeQL and CI on four Python versions, with the docs deploy failing on 8 October, not re-read on 1 November (9 of 10).

ShieldGemma 40

Read as a model, on the lines used for Granite Guardian (recency 30, deprecation 12, churn 8, responsiveness 25, packages 15, health 10). The newest file change is ShieldGemma 2 on 4 April 2025, 19 months before the check, and ShieldGemma 1 last changed in September 2024 (0 of 30). No deprecation policy. Both generations stay downloadable, and the ai.google.dev page was marked deprecated with a pointer to gemma.ai without dates for the models (3 of 12). Two generations in 2024 and 2025, each in its own repository, none replaced in place (6 of 8). Google accounts (members of Google's Gemma organisations on the Hub) answered every thread we sampled on the 2B, 9B and ShieldGemma 2 pages, from August 2024 to 22 March 2026, but leave most threads open (16 of 25). Transformers, Keras and Ollama's library load it (12 of 15). No CI, and Ollama's library build was last updated 2 years ago (3 of 10). 0 + 3 + 6 + 16 + 12 + 3 = 40.

OpenAI Guardrails 82

MIT licence in the repository and on PyPI (30). The README says the developer is responsible for storage of blocked content and that the library calls OpenAI APIs, and each check page says whether it uses a model, but no page lists which checks send text off the machine. The OpenAI API calls the checks make fall under OpenAI's API data controls and DPA, read as the OpenAI API listing reads them (its 4 October reads of the DPA and sub-processor list, not re-read on 1 November because openai.com answers our reader with a bot check). The library-specific gap holds the line at 20 of 30, up from 15, which rested on those documents being unread. No deprecation policy. RELEASING.md states that breaking changes bump the minor version before 1.0 (8 of 20). No telemetry was found in the source. Requests to api.openai.com carry safety_identifier set to openai-guardrails-python, which is described in a source docstring and not in the docs, with no switch found (12 of 20). 30+20+8+12 = 70.

ShieldGemma 54

The weights are under the Gemma Terms of Use, not an OSI licence. They carry distribution conditions, the Prohibited Use Policy and a clause that lets Google restrict usage remotely where it believes the terms are breached. The terms are dated (1 April 2026) with earlier versions archived (15 of 30). Inputs stay on the owner's hardware, so no privacy statement applies. ShieldGemma 1 was fine-tuned on synthetic internal data and public datasets described in a technical report, and ShieldGemma 2 on a WebLI subset and synthetic images with CSAM filtering. No data is released (20 of 30). No deprecation policy or dated model retirements (5 of 20). The weights carry no telemetry of their own, with no statement either way, and downloads go through Hugging Face, Kaggle or Ollama (10 of 20). 15 + 20 + 5 + 10 = 50.

OpenAI Guardrails 73

Local-software reading. Installs from PyPI as openai-guardrails, Python 3.11 to 3.14 stated (20). Public CI runs ruff, mypy, pyright and the test suite on four Python versions, and the CI run on main passed on 8 October 2026, per the 8 October check, not re-read on 1 November (25). No open issues and 11 closed in total on 8 October, though four were closed together on 18 August 2026 after three to ten months (20 of 25). Semver tags, and CHANGELOG.md, which starts at 0.3.3, marks no breaking change through 0.3.6. RELEASING.md says breaking changes bump the minor version before 1.0 (8 of 15). Version 0.3.6, tagged 26 October 2026, and the README title still reads Preview (0).

ShieldGemma 46

Scored on the local-software lines, since the owner runs the model, the reading used for Llama Guard and Granite Guardian. Google's install line is pip install -U transformers[accelerate] with no versions, a Keras Colab notebook covers ShieldGemma 1, and Ollama's own library carries ShieldGemma 1. No Python version or memory figure is stated, and the publisher's files sit behind a login and licence click-through (12 of 20). No CI, tests or evaluation code for the models were found. The technical reports describe the evaluation and nothing reruns it (0 of 25). On the Hub, 8 of 23 threads on the 2B, 2 of 10 on the 9B, none of 8 on the 27B and 9 of 10 on ShieldGemma 2 are open, but every open thread we sampled has a reply from a Google account, the newest on 22 March 2026 (15 of 25). No changelog or version tags. The two generations are named and sit in their own repositories (4 of 15). Released with no preview label (15 of 15). 12 + 0 + 15 + 4 + 15 = 46.

OpenAI Guardrails 66

Framework reading. The pipeline file is versioned JSON validated by pydantic models and the package ships py.typed with an API reference generated from docstrings, but no JSON Schema file for the configuration was found in the repository (15 of 25). llms.txt on the docs site returns 404 (0). Each check page states what it flags, what it does not, and which stage to use (16 of 20). Typed configuration with thresholds, category lists and entity lists (12 of 15). Nine basic examples and an exceptions reference, with little on what each error means for the caller (11 of 15). Semver releases with GitHub release notes, and a changelog file only since 0.3.3 (12 of 15). The docs deploy workflow failed on main on 8 October 2026.

ShieldGemma 56

Read for a model the owner serves. There is no specification of its own. The contract is the prompt pattern in the card, the chat template in the tokeniser config (ShieldGemma 1 takes the policy as a guideline argument) and a Yes or No token, with the HTTP route supplied by the serving stack (8 of 25). gemma.ai/llms.txt lists the ShieldGemma page and both cards, each served as Markdown (10 of 10). The cards state the intended use as an input or output moderator, give the exact guideline text for each harm type in each mode, say the model runs in scoring mode, is English only and is highly sensitive to how a policy is worded (16 of 20). Fixed harm types and a binary answer, with the policy as free text (10 of 15). A Transformers snippet for each generation and a Keras notebook. No failure modes or error cases are documented (8 of 15). Two named generations with no changelog, and the ai.google.dev page is marked deprecated in favour of gemma.ai (4 of 15). 8 + 10 + 16 + 10 + 8 + 4 = 56.

OpenAI Guardrails 60

Self-hosted rule. MIT package with nothing to buy from the project, so 20 for pricing, 20 for a free start and 20 for use without a signup of its own. No payment protocol (0). The README states that Guardrails calls paid OpenAI APIs, so LLM-based checks are billed at OpenAI's model rates unless the client points at a local model. The moderation check page says that call has no cost.

ShieldGemma 52

Self-hosted rule. Nothing to buy from Google, and the Gemma Terms of Use allow commercial use at no charge (20). Free to run with no card (20). Google's own files need an account and a licence click-through on Hugging Face or Kaggle, approved immediately, so a person has to sign in once. Ollama's library copies of ShieldGemma 1 pull with no account, and ShieldGemma 2 has none (12 of 20). No payment protocol (0). No hosted ShieldGemma from Google or an inference provider was found. 20 + 20 + 12 + 0 = 52.

OpenAI Guardrails 59

Framework reading. No credential of its own. It uses the OpenAI API key, or the key of whichever compatible endpoint is set, from the environment or the constructor (10 of 30). The prompt injection check runs before and after each tool call in the Agents SDK and can reject or halt, but there is no human approval step, and check failures pass by default (10 of 20). Jailbreak and prompt injection detection are the product, with a published benchmark in which the default model scores 0.000 recall at a 1 per cent false positive rate (13 of 15). Per-call results with check name, stage, confidence and token usage, and no log sink of its own (9 of 15). SECURITY.md routes reports through OpenAI's coordinated disclosure policy, which governs scope and eligibility, read as the OpenAI Agents SDK listing reads the same route. security.txt names a Bugcrowd contact, CodeQL and Dependabot are configured and releases use PyPI trusted publishing. 3 points are held back because the check bypasses fixed in 0.3.3 and 0.3.4 were released as bug fixes with no advisory (17 of 20).

ShieldGemma 53

Read as a model the owner runs, on the model lines used for Granite Guardian, with retention and training in place of the read-only line. No key is needed to run it. Google's files need a Hugging Face login and licence acceptance, approved immediately, so there is a token to download but no secret at run time (13 of 30). Self-hosted, so inputs stay on the owner's hardware and nothing reaches Google, though no Google page says so (15 of 20). It reads untrusted text by design. The card says the model is highly sensitive to the policy wording and may behave unpredictably with ambiguous language, and gives no prompt-injection guidance (6 of 15). No call log of its own, though each call returns a score (5 of 15). Weights are safetensors only and load through Transformers classes with no remote code. Google's security.txt is valid and points to its reward programme, and there is no model-specific security page or advisory record (14 of 20). 13 + 15 + 6 + 5 + 14 = 53.