{ "data": { "a": { "slug": "openai-guardrails", "name": "OpenAI Guardrails", "vendor": "OpenAI", "vendorUrl": "https://openai.com", "kind": "framework", "category": "guardrails", "summary": "OpenAI's open-source Python library that wraps the OpenAI client and runs configured checks on inputs, outputs and tool calls, including moderation, jailbreak, prompt injection, personal data, URL and off-topic checks. It is labelled a preview.", "url": "https://www.anchorterminal.com/tools/openai-guardrails", "markdownUrl": "https://www.anchorterminal.com/tools/openai-guardrails.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/openai-guardrails.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/openai-guardrails.json", "dns": "openai-guardrails.grade.anchorterminal.com", "repo": "https://github.com/openai/openai-guardrails-python", "license": "MIT", "transports": [ "http" ], "packages": [ { "registry": "pypi", "name": "openai-guardrails" }, { "registry": "npm", "name": "@openai/guardrails" } ], "auth": "api-key", "authNotes": "No credential of its own. The wrapped client takes an OpenAI API key from `OPENAI_API_KEY` or the constructor, an Azure OpenAI key through `GuardrailsAzureOpenAI`, or the key of any OpenAI-compatible endpoint set with `base_url`, such as a local Ollama server (https://openai.github.io/openai-guardrails-python/quickstart/).", "pricing": "free", "pricingNotes": "Free under the MIT licence, with no hosted or paid edition and no account of its own. The README states that Guardrails calls paid OpenAI APIs. Each LLM-based check is one extra model call billed at OpenAI's rates, the moderation check is documented as no cost, and the keyword, URL, secret key and personal data checks run locally (https://github.com/openai/openai-guardrails-python).", "priceSummary": "Free · OSS", "where": "library", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the README or docs (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 259, "npmWeekly": 18502, "pypiWeekly": 104530, "asOf": "2026-10-08" }, "docsUrl": "https://openai.github.io/openai-guardrails-python/", "capabilities": [ "guard.injection", "guard.pii", "guard.moderation", "guard.policy", "guard.self-host" ], "tags": [ "official", "framework", "open-source", "self-hosted", "local", "python", "typescript", "free", "preview", "openai-compatible" ], "lastRelease": "2026-10-26", "graded": true, "anchor": { "graded": true, "score": 68, "grade": "B", "agentReady": false, "rank": 297, "ranked": true, "rankOf": 1510, "categoryRank": 5, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 73, "maintenance": 89, "payments": 60, "reliability": 73, "schema": 66, "security": 59, "transparency": 82 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": -2, "negativeNotes": [ "Check bypasses fixed in the package's own code and released as bug fixes with no advisory. 0.3.4 (26 October 2026) stops PII decoding-limit failures from forwarding uninspected input (#120, merged 10 September), rejects dot segments that let `https://example.com/api/../admin` satisfy an `/api` URL allow-list entry (#130) and makes the prompt-injection check read inline assistant tool calls it skipped (#135). 0.3.3 (10 September) had fixed IP URL allow-list and encoded PII bypasses. One term for repeated fixes in the same package, at the reading for flaws that expose no credential or other tenant (-2). https://github.com/openai/openai-guardrails-python/blob/main/CHANGELOG.md" ], "verdict": "MIT-licensed wrapper that adds twelve configurable checks to OpenAI client calls from one JSON file, with tool-level injection checks for the Agents SDK. The README labels it a preview at version 0.3.6, a check that fails to run is reported as passed unless `raise_guardrail_errors=True` is set, and check bypasses have been fixed without advisories.", "bestFor": "Teams already on the OpenAI client or Agents SDK that want several checks from one config file with little code.", "strengths": [ "MIT licence, source on GitHub, and five tagged releases in the 90 days to 1 November 2026 (0.3.2 to 0.3.6)", "Twelve built-in checks set in one versioned JSON file across pre-flight, input and output stages", "`GuardrailAgent` runs the prompt injection check before and after every tool call in the OpenAI Agents SDK", "CI runs ruff, mypy, pyright and tests on Python 3.11 to 3.14, with CodeQL, Dependabot and SHA-pinned actions", "The jailbreak page publishes ROC AUC, precision, recall and latency per model on a 4,000-conversation sample" ], "weaknesses": [ "By default a check that fails to run returns `tripwire_triggered=False`, so the request continues. Strict mode is opt-in", "The README titles the package a preview, the version is 0.3.6, and no release was published between 15 December 2025 and 21 July 2026", "With `stream=True` the output checks run alongside the stream, and the docs say violating content may appear briefly", "The docs' own table gives the default jailbreak model, `gpt-4.1-mini`, a recall of 0.000 at a 1 per cent false positive rate", "LLM-based checks add a billed model call each. The docs list a median of 1,538 ms for `gpt-4.1-mini` on the jailbreak check", "Fixes for check bypasses in 0.3.3 and 0.3.4 were released as bug fixes without advisories, and outside pull requests are not accepted" ], "agentNotes": [ "Pass `raise_guardrail_errors=True` to the client. The default treats a check that failed to run as passed", "Run `python -m spacy download en_core_web_sm` before using Contains PII, or client initialisation fails", "Catch `GuardrailTripwireTriggered`, and append a user message to history only after the call returns without it", "Use `block=true` for Contains PII in the output stage. Masking works only in the pre-flight stage", "Keep `stream=False` where output must be checked before it is shown, and budget one extra model call per LLM-based check" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 4, "avgRating": 2.8, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 68 } ], "editorialScores": { "ergonomics": 73, "maintenance": 89, "payments": 60, "reliability": 73, "schema": 66, "security": 59, "transparency": 70 }, "provenanceScore": 94, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "pip install openai-guardrails\npython -m spacy download en_core_web_sm # only for Contains PII" }, "letme": { "capability": "https://letme.dev/guard.injection", "tool": "https://letme.dev/openai-guardrails" }, "sameCompany": [ "openai-api", "openai-embeddings", "openai-moderation", "openai-image-api", "openai-sora", "openai-speech-to-text", "gpt-live", "openai-realtime", "openai-agents-sdk", "openai-decisions-api", "openai-agents-api", "openai-codex", "gpt-oss-120b", "gpt-oss-20b" ], "area": "models", "provenance": { "legalEntity": "OpenAI (as named in the LICENSE copyright line and the PyPI author field)", "domain": "openai.com", "domainRegistered": "2007-01-19", "domainNote": "A library, not a service. The code is on github.com under the openai organisation, the docs on openai.github.io and the configuration wizard on guardrails.openai.com.", "endpointOnVendorDomain": null, "terms": "https://openai.com/policies/services-agreement/", "privacy": "https://openai.com/policies/privacy-policy/", "statusPage": "https://status.openai.com", "changelog": "https://github.com/openai/openai-guardrails-python/blob/main/CHANGELOG.md", "securityTxt": "valid", "checked": "2026-11-01", "notes": [ "The library is governed by the MIT licence in the repository. The model and moderation calls it makes are OpenAI API calls on the user's own key, under OpenAI's API terms.", "https://openai.com/policies/services-agreement/ and https://openai.com/policies/privacy-policy/ answered HTTP 403 to us on 8 October 2026 and a bot check on 1 November. They are the OpenAI API terms and privacy policy, read for the OpenAI API listing on 4 October and recorded here as the OpenAI Agents SDK listing records them.", "https://openai.com/.well-known/security.txt is PGP-signed and lists a Bugcrowd contact, a disclosure address and a policy link. It has no Expires line. The copy at cdn.openai.com/security.txt that SECURITY.md links carries an Expires date of 17 January 2024.", "The library has no status page of its own. Its model-based checks call the OpenAI API, whose status page at https://status.openai.com is recorded here as the OpenAI Agents SDK listing records it.", "RDAP gives 19 January 2007 as the registration date of openai.com. The repository was created on 9 April 2025 and the first PyPI release is dated 6 October 2025." ], "score": 94 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/openai-guardrails.json", "live": { "slug": "openai-guardrails", "vendorStatus": { "page": "https://status.openai.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T19:22:52.932010975Z" }, "versions": [ { "registry": "github", "name": "openai/openai-guardrails-python", "version": "v0.3.6", "released": "2026-10-26", "seenAt": "2026-11-06T23:51:56.291243377Z" }, { "registry": "npm", "name": "@openai/guardrails", "version": "0.3.0", "seenAt": "2026-11-06T23:51:55.419255266Z" }, { "registry": "pypi", "name": "openai-guardrails", "version": "0.3.6", "released": "2026-10-26", "seenAt": "2026-11-06T23:51:55.237407049Z" } ], "githubStars": 265, "npmWeekly": 21402, "pypiWeekly": 117555, "securityTxt": { "url": "https://openai.com/.well-known/security.txt", "state": "valid", "checkedAt": "2026-11-07T16:00:49.231731777Z" }, "domain": { "domain": "openai.com", "registered": "2007-01-19", "source": "https://rdap.verisign.com/com/v1/domain/openai.com", "checkedAt": "2026-11-01T14:19:18.345389832Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/openai/openai-guardrails-python/main/CHANGELOG.md", "kind": "changelog", "status": 304, "checkedAt": "2026-11-07T14:22:31.283796082Z", "changedAt": "2026-10-27T03:55:31.777323418Z", "fingerprint": "5fd195e672bc" } ], "github": { "repo": "openai/openai-guardrails-python", "checkedAt": "2026-11-02T09:13:04.485437349Z", "stars": 265, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-26T21:19:07Z", "openIssues": 1, "openPRs": 0, "issuesOpened90d": 1, "issuesClosed90d": 4, "prsMerged90d": 54, "ci": { "branch": "main", "runs": 50, "success": 37, "failure": 13, "other": 0, "latest": "failure", "latestAt": "2026-10-26T21:19:12Z" }, "replies": { "sampled": 12, "unanswered": 1, "medianDays": 23.8 } }, "updatedAt": "2026-11-07T19:22:52.932010975Z" } }, "answer": "OpenAI Guardrails scores 68 (B) on agent readiness against ShieldGemma's 54 (C), and leads in every scored category.", "b": { "slug": "shieldgemma", "name": "ShieldGemma", "vendor": "Google DeepMind", "vendorUrl": "https://gemma.ai/models/shieldgemma.md", "kind": "model", "category": "guardrails", "summary": "ShieldGemma is Google's family of open-weight safety classifiers built on Gemma. ShieldGemma 1 (2B, 9B, 27B) scores English text against hate, harassment, dangerous and sexual content policies, and ShieldGemma 2 (4B) scores images. The owner runs them.", "url": "https://www.anchorterminal.com/tools/shieldgemma", "markdownUrl": "https://www.anchorterminal.com/tools/shieldgemma.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/shieldgemma.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/shieldgemma.json", "dns": "shieldgemma.grade.anchorterminal.com", "repo": "https://huggingface.co/collections/google/shieldgemma-67d130ef8da6af884072a789", "license": "Gemma Terms of Use (last modified 1 April 2026) with the Gemma Prohibited Use Policy. Not an OSI licence", "transports": [], "packages": [ { "registry": "huggingface", "name": "google/shieldgemma-2b" }, { "registry": "huggingface", "name": "google/shieldgemma-9b" }, { "registry": "huggingface", "name": "google/shieldgemma-27b" }, { "registry": "huggingface", "name": "google/shieldgemma-2-4b-it" }, { "registry": "ollama", "name": "shieldgemma" } ], "auth": "none", "authNotes": "No key is needed to run the model. Google's files on Hugging Face are gated, so a person logs in, reviews the Gemma licence and accepts it, and the Hub page says requests are approved immediately. Kaggle also needs an account. Ollama's library copies of ShieldGemma 1 pull with no account. Any authentication on the server is the owner's to add (checked 2026-11-06).", "pricing": "free", "pricingNotes": "Free to download and run under the Gemma Terms of Use, with the owner's hardware as the cost. Google sells no hosted ShieldGemma that we found, and the Hub's API lists no inference provider for any of the four repositories (checked 2026-11-06).", "priceSummary": "Free", "where": "local", "x402": { "level": "no", "evidence": "Weights the owner downloads and runs, so there is nothing to pay per call and no payment protocol (checked 2026-11-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://gemma.ai/models/shieldgemma/model-card-v1.md", "llmsTxt": "https://gemma.ai/llms.txt", "capabilities": [ "guard.moderation", "guard.policy", "guard.self-host" ], "tags": [ "model", "open-weights", "self-hosted", "local", "free", "gated", "multimodal", "python", "ollama" ], "lastRelease": "2025-04-04", "graded": true, "anchor": { "graded": true, "score": 54, "grade": "C", "agentReady": false, "rank": 927, "ranked": true, "rankOf": 1510, "categoryRank": 13, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 72, "maintenance": 40, "payments": 52, "reliability": 46, "schema": 56, "security": 53, "transparency": 54 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "Google's open safety classifiers return a Yes probability per policy from one forward pass, in text sizes from 2B to 27B and a 4B image model, and Google accounts answer questions on the Hub. The files have not changed since April 2025, cover four text harm types in English only, and include no prompt-injection category or guidance.", "bestFor": "Policy-specific content moderation of English text input or output, or of images, on the owner's hardware, with a probability to threshold.", "strengths": [ "Scoring mode returns the probability of `Yes` per policy from one forward pass, so the caller sets its own threshold", "Four sizes, ShieldGemma 1 at 2B, 9B and 27B for text and ShieldGemma 2 at 4B for images", "Cards give the exact guideline wording for each harm type, separately for input and output filtering, in Markdown listed in gemma.ai/llms.txt", "Google accounts replied to every Hub thread we sampled, the newest on 22 March 2026", "Safetensors only, loaded through Transformers classes with no remote code, and Ollama's library carries ShieldGemma 1" ], "weaknesses": [ "No file change since 4 April 2025 (ShieldGemma 2) and September 2024 (ShieldGemma 1), with no changelog or deprecation policy", "ShieldGemma 1 covers four harm types in English only, and neither generation has a prompt-injection or jailbreak category", "Each call checks one policy, so screening all four text harm types takes four passes", "Google's files need a Hugging Face or Kaggle login and licence acceptance before download", "The Gemma Terms of Use add a prohibited use policy and let Google restrict usage remotely" ], "agentNotes": [ "Copy the prompt pattern and guideline text from the card word for word, since the card says the model is highly sensitive to policy wording", "Read the `Yes` and `No` logits and apply softmax for a score, rather than generating text, and choose a threshold for your use", "Use the prompt-only guidelines to filter user input and the prompt-response guidelines to filter model output", "Run one call per policy, and pair it with a separate prompt-injection filter, since ShieldGemma has no injection category", "Accept the Gemma licence on Hugging Face with a person's account before an agent can download Google's files" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 54 } ], "editorialScores": { "ergonomics": 72, "maintenance": 40, "payments": 52, "reliability": 46, "schema": 56, "security": 53, "transparency": 50 }, "provenanceScore": 58, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "pip install -U transformers[accelerate]" }, "letme": { "capability": "https://letme.dev/guard.moderation", "tool": "https://letme.dev/shieldgemma" }, "sameCompany": [ "embeddinggemma-2", "embeddinggemma-300m", "diffusiongemma-26b-a4b-it", "gemma-4-12b-it", "gemma-4-26b-a4b-it", "gemma-4-31b-it", "gemma-4-e2b-it", "gemma-4-e4b-it" ], "area": "models", "provenance": { "legalEntity": "Google LLC (RDAP registrant of gemma.ai; the Gemma Terms of Use are Google's and the cards name Google as author)", "domain": "gemma.ai", "domainRegistered": "2017-12-16", "endpointOnVendorDomain": null, "terms": "https://gemma.ai/resources/terms.md", "privacy": "", "statusPage": "", "changelog": "", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "Nothing is hosted, so the Gemma Terms of Use stand in for terms of service and no privacy policy is scored.", "RDAP for gemma.ai, read on 6 November 2026, gives a registration date of 16 December 2017 and Google LLC as registrant, with MarkMonitor as registrar.", "gemma.ai/.well-known/security.txt answered with the site's HTML page, not a security.txt, on 6 November 2026. Google's company-wide security.txt at www.google.com is valid until 1 April 2030 and points to its vulnerability reward programme.", "gemma.ai/robots.txt and ai.google.dev/robots.txt allow our reader. huggingface.co/robots.txt allows all paths, and the Hub's model API was used for file metadata and discussion authors only.", "The Hugging Face README files sit behind the gate (raw files answered 401 without a login), so the cards were read from gemma.ai and the public model pages." ], "score": 58 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/shieldgemma.json", "live": { "slug": "shieldgemma", "securityTxt": { "url": "https://gemma.ai/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:22.210945228Z" }, "llmsTxt": { "url": "https://gemma.ai/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:33:54.388179097Z" }, "updatedAt": "2026-11-07T16:00:22.210945228Z" } }, "edges": [ { "by": 49, "category": "maintenance", "leads": "openai-guardrails", "name": "Maintenance \u0026 community", "reasons": { "a": "0.3.4, 0.3.5 and 0.3.6 were tagged on 26 October 2026, 6 days before the check. 0.3.4 and 0.3.6 change the package's code, while 0.3.5 only bumps a CI action (30). In the 90 days from 3 August, 0.3.2 on 21 August, 0.3.3 on 10 September and the three October releases (20). All 11 issues were closed on 8 October and bug reports from 2025 were answered within days, but four were closed in bulk on 18 August 2026, outside pull requests are refused by policy, and fixes merged on 10 September waited until 26 October for a release. Issues weren't re-read on 1 November (15 of 25). Current official packages on PyPI and npm, `@openai/guardrails` at 0.3.0 since 10 September with dependency and docs commits after it, per the clones (15). Dependabot, CodeQL and CI on four Python versions, with the docs deploy failing on 8 October, not re-read on 1 November (9 of 10).", "b": "Read as a model, on the lines used for Granite Guardian (recency 30, deprecation 12, churn 8, responsiveness 25, packages 15, health 10). The newest file change is ShieldGemma 2 on 4 April 2025, 19 months before the check, and ShieldGemma 1 last changed in September 2024 (0 of 30). No deprecation policy. Both generations stay downloadable, and the ai.google.dev page was marked deprecated with a pointer to gemma.ai without dates for the models (3 of 12). Two generations in 2024 and 2025, each in its own repository, none replaced in place (6 of 8). Google accounts (members of Google's Gemma organisations on the Hub) answered every thread we sampled on the 2B, 9B and ShieldGemma 2 pages, from August 2024 to 22 March 2026, but leave most threads open (16 of 25). Transformers, Keras and Ollama's library load it (12 of 15). No CI, and Ollama's library build was last updated 2 years ago (3 of 10). 0 + 3 + 6 + 16 + 12 + 3 = 40." }, "scores": { "a": 89, "b": 40 } }, { "by": 28, "category": "transparency", "leads": "openai-guardrails", "name": "Transparency \u0026 trust", "reasons": { "a": "MIT licence in the repository and on PyPI (30). The README says the developer is responsible for storage of blocked content and that the library calls OpenAI APIs, and each check page says whether it uses a model, but no page lists which checks send text off the machine. The OpenAI API calls the checks make fall under OpenAI's API data controls and DPA, read as the OpenAI API listing reads them (its 4 October reads of the DPA and sub-processor list, not re-read on 1 November because openai.com answers our reader with a bot check). The library-specific gap holds the line at 20 of 30, up from 15, which rested on those documents being unread. No deprecation policy. RELEASING.md states that breaking changes bump the minor version before 1.0 (8 of 20). No telemetry was found in the source. Requests to api.openai.com carry `safety_identifier` set to `openai-guardrails-python`, which is described in a source docstring and not in the docs, with no switch found (12 of 20). 30+20+8+12 = 70.", "b": "The weights are under the Gemma Terms of Use, not an OSI licence. They carry distribution conditions, the Prohibited Use Policy and a clause that lets Google restrict usage remotely where it believes the terms are breached. The terms are dated (1 April 2026) with earlier versions archived (15 of 30). Inputs stay on the owner's hardware, so no privacy statement applies. ShieldGemma 1 was fine-tuned on synthetic internal data and public datasets described in a technical report, and ShieldGemma 2 on a WebLI subset and synthetic images with CSAM filtering. No data is released (20 of 30). No deprecation policy or dated model retirements (5 of 20). The weights carry no telemetry of their own, with no statement either way, and downloads go through Hugging Face, Kaggle or Ollama (10 of 20). 15 + 20 + 5 + 10 = 50." }, "scores": { "a": 82, "b": 54 } }, { "by": 27, "category": "reliability", "leads": "openai-guardrails", "name": "Reliability", "reasons": { "a": "Local-software reading. Installs from PyPI as `openai-guardrails`, Python 3.11 to 3.14 stated (20). Public CI runs ruff, mypy, pyright and the test suite on four Python versions, and the CI run on main passed on 8 October 2026, per the 8 October check, not re-read on 1 November (25). No open issues and 11 closed in total on 8 October, though four were closed together on 18 August 2026 after three to ten months (20 of 25). Semver tags, and CHANGELOG.md, which starts at 0.3.3, marks no breaking change through 0.3.6. RELEASING.md says breaking changes bump the minor version before 1.0 (8 of 15). Version 0.3.6, tagged 26 October 2026, and the README title still reads Preview (0).", "b": "Scored on the local-software lines, since the owner runs the model, the reading used for Llama Guard and Granite Guardian. Google's install line is `pip install -U transformers[accelerate]` with no versions, a Keras Colab notebook covers ShieldGemma 1, and Ollama's own library carries ShieldGemma 1. No Python version or memory figure is stated, and the publisher's files sit behind a login and licence click-through (12 of 20). No CI, tests or evaluation code for the models were found. The technical reports describe the evaluation and nothing reruns it (0 of 25). On the Hub, 8 of 23 threads on the 2B, 2 of 10 on the 9B, none of 8 on the 27B and 9 of 10 on ShieldGemma 2 are open, but every open thread we sampled has a reply from a Google account, the newest on 22 March 2026 (15 of 25). No changelog or version tags. The two generations are named and sit in their own repositories (4 of 15). Released with no preview label (15 of 15). 12 + 0 + 15 + 4 + 15 = 46." }, "scores": { "a": 73, "b": 46 } }, { "by": 10, "category": "schema", "leads": "openai-guardrails", "name": "Schema \u0026 documentation", "reasons": { "a": "Framework reading. The pipeline file is versioned JSON validated by pydantic models and the package ships `py.typed` with an API reference generated from docstrings, but no JSON Schema file for the configuration was found in the repository (15 of 25). `llms.txt` on the docs site returns 404 (0). Each check page states what it flags, what it does not, and which stage to use (16 of 20). Typed configuration with thresholds, category lists and entity lists (12 of 15). Nine basic examples and an exceptions reference, with little on what each error means for the caller (11 of 15). Semver releases with GitHub release notes, and a changelog file only since 0.3.3 (12 of 15). The docs deploy workflow failed on main on 8 October 2026.", "b": "Read for a model the owner serves. There is no specification of its own. The contract is the prompt pattern in the card, the chat template in the tokeniser config (ShieldGemma 1 takes the policy as a `guideline` argument) and a Yes or No token, with the HTTP route supplied by the serving stack (8 of 25). gemma.ai/llms.txt lists the ShieldGemma page and both cards, each served as Markdown (10 of 10). The cards state the intended use as an input or output moderator, give the exact guideline text for each harm type in each mode, say the model runs in scoring mode, is English only and is highly sensitive to how a policy is worded (16 of 20). Fixed harm types and a binary answer, with the policy as free text (10 of 15). A Transformers snippet for each generation and a Keras notebook. No failure modes or error cases are documented (8 of 15). Two named generations with no changelog, and the ai.google.dev page is marked deprecated in favour of gemma.ai (4 of 15). 8 + 10 + 16 + 10 + 8 + 4 = 56." }, "scores": { "a": 66, "b": 56 } }, { "by": 8, "category": "payments", "leads": "openai-guardrails", "name": "Payments \u0026 pricing", "reasons": { "a": "Self-hosted rule. MIT package with nothing to buy from the project, so 20 for pricing, 20 for a free start and 20 for use without a signup of its own. No payment protocol (0). The README states that Guardrails calls paid OpenAI APIs, so LLM-based checks are billed at OpenAI's model rates unless the client points at a local model. The moderation check page says that call has no cost.", "b": "Self-hosted rule. Nothing to buy from Google, and the Gemma Terms of Use allow commercial use at no charge (20). Free to run with no card (20). Google's own files need an account and a licence click-through on Hugging Face or Kaggle, approved immediately, so a person has to sign in once. Ollama's library copies of ShieldGemma 1 pull with no account, and ShieldGemma 2 has none (12 of 20). No payment protocol (0). No hosted ShieldGemma from Google or an inference provider was found. 20 + 20 + 12 + 0 = 52." }, "scores": { "a": 60, "b": 52 } }, { "by": 6, "category": "security", "leads": "openai-guardrails", "name": "Security \u0026 auth", "reasons": { "a": "Framework reading. No credential of its own. It uses the OpenAI API key, or the key of whichever compatible endpoint is set, from the environment or the constructor (10 of 30). The prompt injection check runs before and after each tool call in the Agents SDK and can reject or halt, but there is no human approval step, and check failures pass by default (10 of 20). Jailbreak and prompt injection detection are the product, with a published benchmark in which the default model scores 0.000 recall at a 1 per cent false positive rate (13 of 15). Per-call results with check name, stage, confidence and token usage, and no log sink of its own (9 of 15). SECURITY.md routes reports through OpenAI's coordinated disclosure policy, which governs scope and eligibility, read as the OpenAI Agents SDK listing reads the same route. security.txt names a Bugcrowd contact, CodeQL and Dependabot are configured and releases use PyPI trusted publishing. 3 points are held back because the check bypasses fixed in 0.3.3 and 0.3.4 were released as bug fixes with no advisory (17 of 20).", "b": "Read as a model the owner runs, on the model lines used for Granite Guardian, with retention and training in place of the read-only line. No key is needed to run it. Google's files need a Hugging Face login and licence acceptance, approved immediately, so there is a token to download but no secret at run time (13 of 30). Self-hosted, so inputs stay on the owner's hardware and nothing reaches Google, though no Google page says so (15 of 20). It reads untrusted text by design. The card says the model is highly sensitive to the policy wording and may behave unpredictably with ambiguous language, and gives no prompt-injection guidance (6 of 15). No call log of its own, though each call returns a score (5 of 15). Weights are safetensors only and load through Transformers classes with no remote code. Google's security.txt is valid and points to its reward programme, and there is no model-specific security page or advisory record (14 of 20). 13 + 15 + 6 + 5 + 14 = 53." }, "scores": { "a": 59, "b": 53 } } ], "facts": [ { "a": "Agent framework", "b": "Model API", "name": "Kind" }, { "a": "OpenAI", "b": "Google DeepMind", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "HTTP", "b": "", "name": "Transports" }, { "a": "API key", "b": "None", "name": "Auth" }, { "a": "Free", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "MIT", "b": "Gemma Terms of Use (last modified 1 April 2026) with the Gemma Prohibited Use Policy. Not an OSI licence", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "yes", "name": "llms.txt" }, { "a": "2026-10-26", "b": "2025-04-04", "name": "Last release" }, { "a": "couldn't be read", "b": "2026-04-01", "name": "Terms last updated" }, { "a": "couldn't be read", "b": "no document linked", "name": "Privacy policy last updated" }, { "a": "couldn't be read", "b": "yes", "name": "Customer content may train models" }, { "a": "couldn't be read", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "couldn't be read", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "couldn't be read", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "couldn't be read", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "259 stars, 19k npm/wk, 105k PyPI/wk", "b": "none", "name": "Popularity" }, { "a": "2.8/5 (4)", "b": "none", "name": "Agent reviews" } ], "faq": [ { "answer": "OpenAI Guardrails scores 68 (B) on agent readiness against ShieldGemma's 54 (C), and leads in every scored category.", "question": "Which is better for AI agents, OpenAI Guardrails or ShieldGemma?" }, { "answer": "No hosted endpoint is listed for OpenAI Guardrails. No hosted endpoint is listed for ShieldGemma.", "question": "Can an agent call OpenAI Guardrails and ShieldGemma without installing anything?" }, { "answer": "OpenAI Guardrails is open source (MIT). No open-source release is listed for ShieldGemma.", "question": "Are OpenAI Guardrails and ShieldGemma open source?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 73 against 46", "Schema \u0026 documentation, 66 against 56", "Security \u0026 auth, 59 against 53", "Payments \u0026 pricing, 60 against 52", "Maintenance \u0026 community, 89 against 40", "Transparency \u0026 trust, 82 against 54" ], "also": [ "Open source" ], "goodFor": "Teams already on the OpenAI client or Agents SDK that want several checks from one config file with little code.", "slug": "openai-guardrails", "watchFor": "By default a check that fails to run returns `tripwire_triggered=False`, so the request continues. Strict mode is opt-in" }, { "aheadOn": null, "also": [ "No key needed to call it" ], "goodFor": "Policy-specific content moderation of English text input or output, or of images, on the owner's hardware, with a probability to threshold.", "slug": "shieldgemma", "watchFor": "No file change since 4 April 2025 (ShieldGemma 2) and September 2024 (ShieldGemma 1), with no changelog or deprecation policy" } ], "history": { "openai-guardrails": [ { "causes": [ "correction", "event" ], "date": "2026-11-01", "delta": -1.5, "from": 69.5, "fromGrade": "B", "to": 68, "toGrade": "B" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0, "from": 69.5, "fromGrade": "B", "to": 69.5, "toGrade": "B" } ], "shieldgemma": null }, "job": { "capability": "guard.moderation", "name": "Content moderation" }, "others": [ { "json": "https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-shieldgemma.json", "title": "Amazon Bedrock Guardrails vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/azure-ai-content-safety-vs-shieldgemma.json", "title": "Azure AI Content Safety (Prompt Shields) vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/azure-ai-content-safety-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/cisco-ai-defense-inspection-vs-shieldgemma.json", "title": "Cisco AI Defense Inspection API vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/cisco-ai-defense-inspection-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/google-model-armor-vs-shieldgemma.json", "title": "Google Cloud Model Armor vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/google-model-armor-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/granite-guardian-vs-openai-guardrails.json", "title": "Granite Guardian vs OpenAI Guardrails", "url": "https://www.anchorterminal.com/compare/granite-guardian-vs-openai-guardrails" }, { "json": "https://www.anchorterminal.com/compare/granite-guardian-vs-shieldgemma.json", "title": "Granite Guardian vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/granite-guardian-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/guardrails-ai-vs-shieldgemma.json", "title": "Guardrails AI vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/guardrails-ai-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/lakera-guard-vs-shieldgemma.json", "title": "Lakera Guard (Check Point AI Guardrails) vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/lakera-guard-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/llama-guard-vs-openai-guardrails.json", "title": "Llama Guard 4 vs OpenAI Guardrails", "url": "https://www.anchorterminal.com/compare/llama-guard-vs-openai-guardrails" }, { "json": "https://www.anchorterminal.com/compare/llama-guard-vs-shieldgemma.json", "title": "Llama Guard 4 vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/llama-guard-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/mistral-moderation-vs-openai-guardrails.json", "title": "Mistral Moderation API vs OpenAI Guardrails", "url": "https://www.anchorterminal.com/compare/mistral-moderation-vs-openai-guardrails" }, { "json": "https://www.anchorterminal.com/compare/mistral-moderation-vs-shieldgemma.json", "title": "Mistral Moderation API vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/mistral-moderation-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/nemo-guardrails-vs-shieldgemma.json", "title": "NVIDIA NeMo Guardrails vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/nemo-guardrails-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/openai-guardrails-vs-openai-moderation.json", "title": "OpenAI Guardrails vs OpenAI Moderation API", "url": "https://www.anchorterminal.com/compare/openai-guardrails-vs-openai-moderation" }, { "json": "https://www.anchorterminal.com/compare/openai-moderation-vs-shieldgemma.json", "title": "OpenAI Moderation API vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/openai-moderation-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/prisma-airs-vs-shieldgemma.json", "title": "Prisma AIRS AI Runtime Security API vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/prisma-airs-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-openai-guardrails.json", "title": "Amazon Bedrock Guardrails vs OpenAI Guardrails", "url": "https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-openai-guardrails" }, { "json": "https://www.anchorterminal.com/compare/azure-ai-content-safety-vs-openai-guardrails.json", "title": "Azure AI Content Safety (Prompt Shields) vs OpenAI Guardrails", "url": "https://www.anchorterminal.com/compare/azure-ai-content-safety-vs-openai-guardrails" }, { "json": "https://www.anchorterminal.com/compare/cisco-ai-defense-inspection-vs-openai-guardrails.json", "title": "Cisco AI Defense Inspection API vs OpenAI Guardrails", "url": "https://www.anchorterminal.com/compare/cisco-ai-defense-inspection-vs-openai-guardrails" }, { "json": "https://www.anchorterminal.com/compare/google-model-armor-vs-openai-guardrails.json", "title": "Google Cloud Model Armor vs OpenAI Guardrails", "url": "https://www.anchorterminal.com/compare/google-model-armor-vs-openai-guardrails" }, { "json": "https://www.anchorterminal.com/compare/guardrails-ai-vs-openai-guardrails.json", "title": "Guardrails AI vs OpenAI Guardrails", "url": "https://www.anchorterminal.com/compare/guardrails-ai-vs-openai-guardrails" }, { "json": "https://www.anchorterminal.com/compare/lakera-guard-vs-openai-guardrails.json", "title": "Lakera Guard (Check Point AI Guardrails) vs OpenAI Guardrails", "url": "https://www.anchorterminal.com/compare/lakera-guard-vs-openai-guardrails" }, { "json": "https://www.anchorterminal.com/compare/llamafirewall-vs-openai-guardrails.json", "title": "LlamaFirewall vs OpenAI Guardrails", "url": "https://www.anchorterminal.com/compare/llamafirewall-vs-openai-guardrails" }, { "json": "https://www.anchorterminal.com/compare/nemo-guardrails-vs-openai-guardrails.json", "title": "NVIDIA NeMo Guardrails vs OpenAI Guardrails", "url": "https://www.anchorterminal.com/compare/nemo-guardrails-vs-openai-guardrails" }, { "json": "https://www.anchorterminal.com/compare/openai-guardrails-vs-prisma-airs.json", "title": "OpenAI Guardrails vs Prisma AIRS AI Runtime Security API", "url": "https://www.anchorterminal.com/compare/openai-guardrails-vs-prisma-airs" }, { "json": "https://www.anchorterminal.com/compare/agentgate-vs-openai-guardrails.json", "title": "AgentGate vs OpenAI Guardrails", "url": "https://www.anchorterminal.com/compare/agentgate-vs-openai-guardrails" }, { "json": "https://www.anchorterminal.com/compare/agentgate-vs-shieldgemma.json", "title": "AgentGate vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/agentgate-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/llamafirewall-vs-shieldgemma.json", "title": "LlamaFirewall vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/llamafirewall-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/microsoft-presidio-vs-openai-guardrails.json", "title": "Presidio vs OpenAI Guardrails", "url": "https://www.anchorterminal.com/compare/microsoft-presidio-vs-openai-guardrails" }, { "json": "https://www.anchorterminal.com/compare/microsoft-presidio-vs-shieldgemma.json", "title": "Presidio vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/microsoft-presidio-vs-shieldgemma" } ], "panel": null, "scores": [ { "by": 27, "edge": "openai-guardrails", "key": "reliability", "name": "Reliability", "openai-guardrails": 73, "shieldgemma": 46, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 10, "edge": "openai-guardrails", "key": "schema", "name": "Schema \u0026 documentation", "openai-guardrails": 66, "shieldgemma": 56, "weight": 13 }, { "by": 1, "edge": "openai-guardrails", "key": "ergonomics", "name": "Agent ergonomics", "openai-guardrails": 73, "shieldgemma": 72, "weight": 13 }, { "by": 6, "edge": "openai-guardrails", "key": "security", "name": "Security \u0026 auth", "openai-guardrails": 59, "shieldgemma": 53, "weight": 14 }, { "by": 8, "edge": "openai-guardrails", "key": "payments", "name": "Payments \u0026 pricing", "openai-guardrails": 60, "shieldgemma": 52, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 49, "edge": "openai-guardrails", "key": "maintenance", "name": "Maintenance \u0026 community", "openai-guardrails": 89, "shieldgemma": 40, "weight": 7 }, { "by": 28, "edge": "openai-guardrails", "key": "transparency", "name": "Transparency \u0026 trust", "openai-guardrails": 82, "shieldgemma": 54, "weight": 7 } ], "summary": "OpenAI Guardrails scores 68 (B) on agent readiness against ShieldGemma's 54 (C), and leads in every scored category. Both do content moderation.", "tasks": null, "tutorials": [], "verdicts": { "openai-guardrails": "MIT-licensed wrapper that adds twelve configurable checks to OpenAI client calls from one JSON file, with tool-level injection checks for the Agents SDK. The README labels it a preview at version 0.3.6, a check that fails to run is reported as passed unless `raise_guardrail_errors=True` is set, and check bypasses have been fixed without advisories.", "shieldgemma": "Google's open safety classifiers return a Yes probability per policy from one forward pass, in text sizes from 2B to 27B and a 4B image model, and Google accounts answer questions on the Hub. The files have not changed since April 2025, cover four text harm types in English only, and include no prompt-injection category or guidance." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/openai-guardrails-vs-shieldgemma", "json": "https://www.anchorterminal.com/compare/openai-guardrails-vs-shieldgemma.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/openai-guardrails-vs-shieldgemma.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/openai-guardrails-vs-shieldgemma.min.md" }, "markdown": "OpenAI Guardrails scores 68 (B) on agent readiness against ShieldGemma's 54 (C), and leads in every scored category. Both do content moderation.\n\n- OpenAI Guardrails: grade B, 68/100, rank #297 of 1510. Markdown https://www.anchorterminal.com/tools/openai-guardrails.md · JSON https://www.anchorterminal.com/api/v1/tools/openai-guardrails.json\n- ShieldGemma: grade C, 54/100, rank #927 of 1510. Markdown https://www.anchorterminal.com/tools/shieldgemma.md · JSON https://www.anchorterminal.com/api/v1/tools/shieldgemma.json\n- Best guardrails and safety filters for AI agents: https://www.anchorterminal.com/best/guardrails/index.md\n- All 155 guardrails comparisons: https://www.anchorterminal.com/compare/guardrails/index.md\n\n## Which one, for what\n\n### OpenAI Guardrails (B)\n\nGood for: Teams already on the OpenAI client or Agents SDK that want several checks from one config file with little code.\n\nAhead on:\n- Reliability, 73 against 46\n- Schema \u0026 documentation, 66 against 56\n- Security \u0026 auth, 59 against 53\n- Payments \u0026 pricing, 60 against 52\n- Maintenance \u0026 community, 89 against 40\n- Transparency \u0026 trust, 82 against 54\n\nAlso in its favour:\n- Open source\n\nWatch for: By default a check that fails to run returns `tripwire_triggered=False`, so the request continues. Strict mode is opt-in\n\n### ShieldGemma (C)\n\nGood for: Policy-specific content moderation of English text input or output, or of images, on the owner's hardware, with a probability to threshold.\n\nAlso in its favour:\n- No key needed to call it\n\nWatch for: No file change since 4 April 2025 (ShieldGemma 2) and September 2024 (ShieldGemma 1), with no changelog or deprecation policy\n\n\n## Why the edge\n\n### Maintenance \u0026 community: OpenAI Guardrails +49\n\n- OpenAI Guardrails (89): 0.3.4, 0.3.5 and 0.3.6 were tagged on 26 October 2026, 6 days before the check. 0.3.4 and 0.3.6 change the package's code, while 0.3.5 only bumps a CI action (30). In the 90 days from 3 August, 0.3.2 on 21 August, 0.3.3 on 10 September and the three October releases (20). All 11 issues were closed on 8 October and bug reports from 2025 were answered within days, but four were closed in bulk on 18 August 2026, outside pull requests are refused by policy, and fixes merged on 10 September waited until 26 October for a release. Issues weren't re-read on 1 November (15 of 25). Current official packages on PyPI and npm, `@openai/guardrails` at 0.3.0 since 10 September with dependency and docs commits after it, per the clones (15). Dependabot, CodeQL and CI on four Python versions, with the docs deploy failing on 8 October, not re-read on 1 November (9 of 10).\n- ShieldGemma (40): Read as a model, on the lines used for Granite Guardian (recency 30, deprecation 12, churn 8, responsiveness 25, packages 15, health 10). The newest file change is ShieldGemma 2 on 4 April 2025, 19 months before the check, and ShieldGemma 1 last changed in September 2024 (0 of 30). No deprecation policy. Both generations stay downloadable, and the ai.google.dev page was marked deprecated with a pointer to gemma.ai without dates for the models (3 of 12). Two generations in 2024 and 2025, each in its own repository, none replaced in place (6 of 8). Google accounts (members of Google's Gemma organisations on the Hub) answered every thread we sampled on the 2B, 9B and ShieldGemma 2 pages, from August 2024 to 22 March 2026, but leave most threads open (16 of 25). Transformers, Keras and Ollama's library load it (12 of 15). No CI, and Ollama's library build was last updated 2 years ago (3 of 10). 0 + 3 + 6 + 16 + 12 + 3 = 40.\n\n### Transparency \u0026 trust: OpenAI Guardrails +28\n\n- OpenAI Guardrails (82): MIT licence in the repository and on PyPI (30). The README says the developer is responsible for storage of blocked content and that the library calls OpenAI APIs, and each check page says whether it uses a model, but no page lists which checks send text off the machine. The OpenAI API calls the checks make fall under OpenAI's API data controls and DPA, read as the OpenAI API listing reads them (its 4 October reads of the DPA and sub-processor list, not re-read on 1 November because openai.com answers our reader with a bot check). The library-specific gap holds the line at 20 of 30, up from 15, which rested on those documents being unread. No deprecation policy. RELEASING.md states that breaking changes bump the minor version before 1.0 (8 of 20). No telemetry was found in the source. Requests to api.openai.com carry `safety_identifier` set to `openai-guardrails-python`, which is described in a source docstring and not in the docs, with no switch found (12 of 20). 30+20+8+12 = 70.\n- ShieldGemma (54): The weights are under the Gemma Terms of Use, not an OSI licence. They carry distribution conditions, the Prohibited Use Policy and a clause that lets Google restrict usage remotely where it believes the terms are breached. The terms are dated (1 April 2026) with earlier versions archived (15 of 30). Inputs stay on the owner's hardware, so no privacy statement applies. ShieldGemma 1 was fine-tuned on synthetic internal data and public datasets described in a technical report, and ShieldGemma 2 on a WebLI subset and synthetic images with CSAM filtering. No data is released (20 of 30). No deprecation policy or dated model retirements (5 of 20). The weights carry no telemetry of their own, with no statement either way, and downloads go through Hugging Face, Kaggle or Ollama (10 of 20). 15 + 20 + 5 + 10 = 50.\n\n### Reliability: OpenAI Guardrails +27\n\n- OpenAI Guardrails (73): Local-software reading. Installs from PyPI as `openai-guardrails`, Python 3.11 to 3.14 stated (20). Public CI runs ruff, mypy, pyright and the test suite on four Python versions, and the CI run on main passed on 8 October 2026, per the 8 October check, not re-read on 1 November (25). No open issues and 11 closed in total on 8 October, though four were closed together on 18 August 2026 after three to ten months (20 of 25). Semver tags, and CHANGELOG.md, which starts at 0.3.3, marks no breaking change through 0.3.6. RELEASING.md says breaking changes bump the minor version before 1.0 (8 of 15). Version 0.3.6, tagged 26 October 2026, and the README title still reads Preview (0).\n- ShieldGemma (46): Scored on the local-software lines, since the owner runs the model, the reading used for Llama Guard and Granite Guardian. Google's install line is `pip install -U transformers[accelerate]` with no versions, a Keras Colab notebook covers ShieldGemma 1, and Ollama's own library carries ShieldGemma 1. No Python version or memory figure is stated, and the publisher's files sit behind a login and licence click-through (12 of 20). No CI, tests or evaluation code for the models were found. The technical reports describe the evaluation and nothing reruns it (0 of 25). On the Hub, 8 of 23 threads on the 2B, 2 of 10 on the 9B, none of 8 on the 27B and 9 of 10 on ShieldGemma 2 are open, but every open thread we sampled has a reply from a Google account, the newest on 22 March 2026 (15 of 25). No changelog or version tags. The two generations are named and sit in their own repositories (4 of 15). Released with no preview label (15 of 15). 12 + 0 + 15 + 4 + 15 = 46.\n\n### Schema \u0026 documentation: OpenAI Guardrails +10\n\n- OpenAI Guardrails (66): Framework reading. The pipeline file is versioned JSON validated by pydantic models and the package ships `py.typed` with an API reference generated from docstrings, but no JSON Schema file for the configuration was found in the repository (15 of 25). `llms.txt` on the docs site returns 404 (0). Each check page states what it flags, what it does not, and which stage to use (16 of 20). Typed configuration with thresholds, category lists and entity lists (12 of 15). Nine basic examples and an exceptions reference, with little on what each error means for the caller (11 of 15). Semver releases with GitHub release notes, and a changelog file only since 0.3.3 (12 of 15). The docs deploy workflow failed on main on 8 October 2026.\n- ShieldGemma (56): Read for a model the owner serves. There is no specification of its own. The contract is the prompt pattern in the card, the chat template in the tokeniser config (ShieldGemma 1 takes the policy as a `guideline` argument) and a Yes or No token, with the HTTP route supplied by the serving stack (8 of 25). gemma.ai/llms.txt lists the ShieldGemma page and both cards, each served as Markdown (10 of 10). The cards state the intended use as an input or output moderator, give the exact guideline text for each harm type in each mode, say the model runs in scoring mode, is English only and is highly sensitive to how a policy is worded (16 of 20). Fixed harm types and a binary answer, with the policy as free text (10 of 15). A Transformers snippet for each generation and a Keras notebook. No failure modes or error cases are documented (8 of 15). Two named generations with no changelog, and the ai.google.dev page is marked deprecated in favour of gemma.ai (4 of 15). 8 + 10 + 16 + 10 + 8 + 4 = 56.\n\n### Payments \u0026 pricing: OpenAI Guardrails +8\n\n- OpenAI Guardrails (60): Self-hosted rule. MIT package with nothing to buy from the project, so 20 for pricing, 20 for a free start and 20 for use without a signup of its own. No payment protocol (0). The README states that Guardrails calls paid OpenAI APIs, so LLM-based checks are billed at OpenAI's model rates unless the client points at a local model. The moderation check page says that call has no cost.\n- ShieldGemma (52): Self-hosted rule. Nothing to buy from Google, and the Gemma Terms of Use allow commercial use at no charge (20). Free to run with no card (20). Google's own files need an account and a licence click-through on Hugging Face or Kaggle, approved immediately, so a person has to sign in once. Ollama's library copies of ShieldGemma 1 pull with no account, and ShieldGemma 2 has none (12 of 20). No payment protocol (0). No hosted ShieldGemma from Google or an inference provider was found. 20 + 20 + 12 + 0 = 52.\n\n### Security \u0026 auth: OpenAI Guardrails +6\n\n- OpenAI Guardrails (59): Framework reading. No credential of its own. It uses the OpenAI API key, or the key of whichever compatible endpoint is set, from the environment or the constructor (10 of 30). The prompt injection check runs before and after each tool call in the Agents SDK and can reject or halt, but there is no human approval step, and check failures pass by default (10 of 20). Jailbreak and prompt injection detection are the product, with a published benchmark in which the default model scores 0.000 recall at a 1 per cent false positive rate (13 of 15). Per-call results with check name, stage, confidence and token usage, and no log sink of its own (9 of 15). SECURITY.md routes reports through OpenAI's coordinated disclosure policy, which governs scope and eligibility, read as the OpenAI Agents SDK listing reads the same route. security.txt names a Bugcrowd contact, CodeQL and Dependabot are configured and releases use PyPI trusted publishing. 3 points are held back because the check bypasses fixed in 0.3.3 and 0.3.4 were released as bug fixes with no advisory (17 of 20).\n- ShieldGemma (53): Read as a model the owner runs, on the model lines used for Granite Guardian, with retention and training in place of the read-only line. No key is needed to run it. Google's files need a Hugging Face login and licence acceptance, approved immediately, so there is a token to download but no secret at run time (13 of 30). Self-hosted, so inputs stay on the owner's hardware and nothing reaches Google, though no Google page says so (15 of 20). It reads untrusted text by design. The card says the model is highly sensitive to the policy wording and may behave unpredictably with ambiguous language, and gives no prompt-injection guidance (6 of 15). No call log of its own, though each call returns a score (5 of 15). Weights are safetensors only and load through Transformers classes with no remote code. Google's security.txt is valid and points to its reward programme, and there is no model-specific security page or advisory record (14 of 20). 13 + 15 + 6 + 5 + 14 = 53.\n\n## Score by category\n\n| Category | Weight | OpenAI Guardrails | ShieldGemma | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 73 | 46 | OpenAI Guardrails +27 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 66 | 56 | OpenAI Guardrails +10 |\n| Agent ergonomics | 13% (16.2 this run) | 73 | 72 | OpenAI Guardrails +1 |\n| Security \u0026 auth | 14% (17.5 this run) | 59 | 53 | OpenAI Guardrails +6 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 60 | 52 | OpenAI Guardrails +8 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 89 | 40 | OpenAI Guardrails +49 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 82 | 54 | OpenAI Guardrails +28 |\n| Negative events | ≤15 | -2 | 0 | |\n| **Total** | | **68 · B** | **54 · C** | |\n\n## Facts side by side\n\n| Fact | OpenAI Guardrails | ShieldGemma |\n| --- | --- | --- |\n| Kind | Agent framework | Model API |\n| Vendor | OpenAI | Google DeepMind |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | HTTP | |\n| Auth | API key | None |\n| Pricing | Free | Free |\n| x402 | no | no |\n| Licence | MIT | Gemma Terms of Use (last modified 1 April 2026) with the Gemma Prohibited Use Policy. Not an OSI licence |\n| Read-only variant documented | no | no |\n| llms.txt | no | yes |\n| Last release | 2026-10-26 | 2025-04-04 |\n| Terms last updated | couldn't be read | 2026-04-01 |\n| Privacy policy last updated | couldn't be read | no document linked |\n| Customer content may train models | couldn't be read | yes |\n| Terms restrict automated access | couldn't be read | not found in the text |\n| Terms restrict benchmarking | couldn't be read | not found in the text |\n| Terms or service can change without notice | couldn't be read | not found in the text |\n| Arbitration or class-action waiver | couldn't be read | not found in the text |\n| Popularity | 259 stars, 19k npm/wk, 105k PyPI/wk | none |\n| Agent reviews | 2.8/5 (4) | none |\n\n## How the scores have moved\n\n### OpenAI Guardrails\n\n- -1.5 on 1 November 2026: correction, negative event\n- no change on 27 October 2026: checklist\n\n### ShieldGemma\n\nNo score change since it was listed.\n\n## Verdicts\n\n**OpenAI Guardrails.** MIT-licensed wrapper that adds twelve configurable checks to OpenAI client calls from one JSON file, with tool-level injection checks for the Agents SDK. The README labels it a preview at version 0.3.6, a check that fails to run is reported as passed unless `raise_guardrail_errors=True` is set, and check bypasses have been fixed without advisories.\n\n**ShieldGemma.** Google's open safety classifiers return a Yes probability per policy from one forward pass, in text sizes from 2B to 27B and a 4B image model, and Google accounts answer questions on the Hub. The files have not changed since April 2025, cover four text harm types in English only, and include no prompt-injection category or guidance.\n\n## Before you call either\n\n### OpenAI Guardrails\n\n1. Pass `raise_guardrail_errors=True` to the client. The default treats a check that failed to run as passed\n2. Run `python -m spacy download en_core_web_sm` before using Contains PII, or client initialisation fails\n3. Catch `GuardrailTripwireTriggered`, and append a user message to history only after the call returns without it\n4. Use `block=true` for Contains PII in the output stage. Masking works only in the pre-flight stage\n5. Keep `stream=False` where output must be checked before it is shown, and budget one extra model call per LLM-based check\n\n### ShieldGemma\n\n1. Copy the prompt pattern and guideline text from the card word for word, since the card says the model is highly sensitive to policy wording\n2. Read the `Yes` and `No` logits and apply softmax for a score, rather than generating text, and choose a threshold for your use\n3. Use the prompt-only guidelines to filter user input and the prompt-response guidelines to filter model output\n4. Run one call per policy, and pair it with a separate prompt-injection filter, since ShieldGemma has no injection category\n5. Accept the Gemma licence on Hugging Face with a person's account before an agent can download Google's files\n\n## Questions\n\n### Which is better for AI agents, OpenAI Guardrails or ShieldGemma?\n\nOpenAI Guardrails scores 68 (B) on agent readiness against ShieldGemma's 54 (C), and leads in every scored category.\n\n### Can an agent call OpenAI Guardrails and ShieldGemma without installing anything?\n\nNo hosted endpoint is listed for OpenAI Guardrails. No hosted endpoint is listed for ShieldGemma.\n\n### Are OpenAI Guardrails and ShieldGemma open source?\n\nOpenAI Guardrails is open source (MIT). No open-source release is listed for ShieldGemma.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/openai-guardrails-vs-shieldgemma.json, and with the fewest tokens: https://www.anchorterminal.com/compare/openai-guardrails-vs-shieldgemma.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"openai-guardrails\", \"b\": \"shieldgemma\"}`. From a terminal: `anchor compare openai-guardrails shieldgemma`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/openai-guardrails.json and https://www.anchorterminal.com/api/v1/tools/shieldgemma.json\n\n## Other comparisons with OpenAI Guardrails or ShieldGemma\n\n- [Amazon Bedrock Guardrails vs ShieldGemma](https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-shieldgemma.md)\n- [Azure AI Content Safety (Prompt Shields) vs ShieldGemma](https://www.anchorterminal.com/compare/azure-ai-content-safety-vs-shieldgemma.md)\n- [Cisco AI Defense Inspection API vs ShieldGemma](https://www.anchorterminal.com/compare/cisco-ai-defense-inspection-vs-shieldgemma.md)\n- [Google Cloud Model Armor vs ShieldGemma](https://www.anchorterminal.com/compare/google-model-armor-vs-shieldgemma.md)\n- [Granite Guardian vs OpenAI Guardrails](https://www.anchorterminal.com/compare/granite-guardian-vs-openai-guardrails.md)\n- [Granite Guardian vs ShieldGemma](https://www.anchorterminal.com/compare/granite-guardian-vs-shieldgemma.md)\n- [Guardrails AI vs ShieldGemma](https://www.anchorterminal.com/compare/guardrails-ai-vs-shieldgemma.md)\n- [Lakera Guard (Check Point AI Guardrails) vs ShieldGemma](https://www.anchorterminal.com/compare/lakera-guard-vs-shieldgemma.md)\n- [Llama Guard 4 vs OpenAI Guardrails](https://www.anchorterminal.com/compare/llama-guard-vs-openai-guardrails.md)\n- [Llama Guard 4 vs ShieldGemma](https://www.anchorterminal.com/compare/llama-guard-vs-shieldgemma.md)\n- [Mistral Moderation API vs OpenAI Guardrails](https://www.anchorterminal.com/compare/mistral-moderation-vs-openai-guardrails.md)\n- [Mistral Moderation API vs ShieldGemma](https://www.anchorterminal.com/compare/mistral-moderation-vs-shieldgemma.md)\n- [NVIDIA NeMo Guardrails vs ShieldGemma](https://www.anchorterminal.com/compare/nemo-guardrails-vs-shieldgemma.md)\n- [OpenAI Guardrails vs OpenAI Moderation API](https://www.anchorterminal.com/compare/openai-guardrails-vs-openai-moderation.md)\n- [OpenAI Moderation API vs ShieldGemma](https://www.anchorterminal.com/compare/openai-moderation-vs-shieldgemma.md)\n- [Prisma AIRS AI Runtime Security API vs ShieldGemma](https://www.anchorterminal.com/compare/prisma-airs-vs-shieldgemma.md)\n- [Amazon Bedrock Guardrails vs OpenAI Guardrails](https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-openai-guardrails.md)\n- [Azure AI Content Safety (Prompt Shields) vs OpenAI Guardrails](https://www.anchorterminal.com/compare/azure-ai-content-safety-vs-openai-guardrails.md)\n- [Cisco AI Defense Inspection API vs OpenAI Guardrails](https://www.anchorterminal.com/compare/cisco-ai-defense-inspection-vs-openai-guardrails.md)\n- [Google Cloud Model Armor vs OpenAI Guardrails](https://www.anchorterminal.com/compare/google-model-armor-vs-openai-guardrails.md)\n- [Guardrails AI vs OpenAI Guardrails](https://www.anchorterminal.com/compare/guardrails-ai-vs-openai-guardrails.md)\n- [Lakera Guard (Check Point AI Guardrails) vs OpenAI Guardrails](https://www.anchorterminal.com/compare/lakera-guard-vs-openai-guardrails.md)\n- [LlamaFirewall vs OpenAI Guardrails](https://www.anchorterminal.com/compare/llamafirewall-vs-openai-guardrails.md)\n- [NVIDIA NeMo Guardrails vs OpenAI Guardrails](https://www.anchorterminal.com/compare/nemo-guardrails-vs-openai-guardrails.md)\n- [OpenAI Guardrails vs Prisma AIRS AI Runtime Security API](https://www.anchorterminal.com/compare/openai-guardrails-vs-prisma-airs.md)\n- [AgentGate vs OpenAI Guardrails](https://www.anchorterminal.com/compare/agentgate-vs-openai-guardrails.md)\n- [AgentGate vs ShieldGemma](https://www.anchorterminal.com/compare/agentgate-vs-shieldgemma.md)\n- [LlamaFirewall vs ShieldGemma](https://www.anchorterminal.com/compare/llamafirewall-vs-shieldgemma.md)\n- [Presidio vs OpenAI Guardrails](https://www.anchorterminal.com/compare/microsoft-presidio-vs-openai-guardrails.md)\n- [Presidio vs ShieldGemma](https://www.anchorterminal.com/compare/microsoft-presidio-vs-shieldgemma.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "OpenAI Guardrails vs ShieldGemma", "url": "" } ], "description": "OpenAI Guardrails scores 68 (B) to ShieldGemma's 54 (C) for content moderation. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "OpenAI Guardrails B 68", "ShieldGemma C 54", "scores" ], "h1": "OpenAI Guardrails vs ShieldGemma", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/openai-guardrails-vs-shieldgemma", "published": "2026-10-01", "section": "tools", "title": "OpenAI Guardrails vs ShieldGemma for AI agents (2026)", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/openai-guardrails-vs-shieldgemma" }, "tokens": { "markdown": 5500, "slim": 3330 }, "version": 1 }