The 10 Best LLM Guardrails and Safety Tools in 2027

Bedrock Guardrails has six safeguard policies: content filters, prompt attack detection, denied topics, word filters, PII redaction, and hallucination checks through contextual grounding and Automated Reasoning. It works with models outside Bedrock, including OpenAI and Gemini. Content filters cost $0.15 per 1,000 text units, or $0.07 through the InvokeGuardrailChecks API.

NeMo Guardrails is NVIDIA’s Apache 2.0 toolkit for programmable rails around an LLM. It ships jailbreak and injection detection, PII masking, moderation, fact-checking and hallucination rails, and it supports five rail types (input, dialog, retrieval, execution and output) written in Colang. You run it as a Python library or as a server.

Azure AI Content Safety pairs Prompt Shields, which catch user prompt attacks and hidden instructions in documents, with harm detection for text and images, groundedness detection in preview and protected material checks. The free tier covers 5,000 text records a month; Standard is $0.38 per 1,000 text records. The pricing page now calls it Content Safety in Foundry Control Plane.

Model Armor screens prompts, responses and agent interactions for prompt injection, jailbreaks, malicious URLs, malware, harmful content and PII. It is a REST API that works with any model on any cloud. It is free for up to 2 million tokens a month, then $0.10 per additional 1 million tokens.

Lakera Guard detects direct and indirect prompt attacks, harmful content, PII and system prompt leaks, malicious links and risky agent actions. Check Point closed its acquisition of Lakera on October 22, 2025, and the docs now call it Check Point AI Guardrails. The Community plan is $0 a month for 10k requests; Enterprise adds self-hosting.

Guardrails AI is an Apache-2.0 Python framework that runs input and output guards built from Guardrails Hub validators, such as toxic language and competitor checks, and also generates structured output. Harvey announced its acquisition of the company in September 2026. Validators are moving to standard PyPI packages, and hosted remote inferencing has a planned cutoff of August 25, 2026.

Llama Guard 4 is Meta’s 12 billion parameter safety classifier for text and multiple images. It flags unsafe prompts or responses across 14 hazard categories, from violent crimes to privacy and code interpreter abuse, and runs on a single GPU. It uses the Llama 4 Community License, and Meta points to Llama Prompt Guard 2 for prompt attacks.

Granite Guardian 3.3 8b is IBM’s Apache 2.0 judge model. Its pre-baked criteria cover jailbreak attempts, profanity and hallucinations in RAG answers and agent tool calls, and you can add your own criteria. It can return a reasoning trace or just a score, and runs on Transformers, vLLM or SGLang.

Cloudflare AI Security for Apps, formerly Firewall for AI, runs inside the Cloudflare WAF. It scans JSON prompts sent to endpoints labeled cf-llm for PII, unsafe or custom topics and prompt injection, and you act on the results with WAF rules. Endpoint discovery is on every plan, but the AI detection fields are an Enterprise paid add-on.

The OpenAI Moderation API is free. Its omni-moderation-latest model scores text and images (up to 20 MB) for categories such as harassment, hate, illicit content, self-harm, sexual content and violence, and it can return scores inline with a Responses API call. It does not classify audio, and it is a content filter rather than an injection or PII guard.