> For the complete documentation index, see [llms.txt](https://docs.mozilla.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.mozilla.ai/any-guardrail/api-reference/index.md).

# Guardrails

Available guardrails, grouped by primary category. Select a guardrail to view its API details. See the [Taxonomy reference](/any-guardrail/api-reference/taxonomy.md) for what each category means.

Query this catalog programmatically with `AnyGuardrail.list_guardrails(...)` and `AnyGuardrail.group_by(...)` — see the [AnyGuardrail reference](/any-guardrail/api-reference/any_guardrail.md).

## Prompt Injection

| Guardrail                                                                                           | Description                                                                                                    |
| --------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- |
| [Azure Prompt Shields](/any-guardrail/api-reference/index/prompt-injection/azure-prompt-shields.md) | Hosted detector for direct (user prompt) and indirect (document-borne) prompt-injection and jailbreak attacks. |
| [Deepset](/any-guardrail/api-reference/index/prompt-injection/deepset.md)                           | Binary prompt-injection classifier.                                                                            |
| [HarmAug-Guard](/any-guardrail/api-reference/index/prompt-injection/harm-guard.md)                  | Binary safety and jailbreak classifier, scoring a prompt or prompt-response pair.                              |
| [Jasper](/any-guardrail/api-reference/index/prompt-injection/jasper.md)                             | Binary prompt-injection classifiers.                                                                           |
| [Lakera Guard](/any-guardrail/api-reference/index/prompt-injection/lakera-guard.md)                 | Hosted API for prompt-injection, jailbreak, content-moderation, and PII detection.                             |
| [Pangolin Guard](/any-guardrail/api-reference/index/prompt-injection/pangolin.md)                   | Binary prompt-injection classifier.                                                                            |
| [PIGuard](/any-guardrail/api-reference/index/prompt-injection/injec-guard.md)                       | Binary prompt-injection classifier trained to mitigate over-defense.                                           |
| [Prompt Guard 2](/any-guardrail/api-reference/index/prompt-injection/prompt-guard.md)               | Encoder classifier for prompt-injection and jailbreak detection.                                               |
| [ProtectAI](/any-guardrail/api-reference/index/prompt-injection/protectai.md)                       | Binary prompt-injection classifiers.                                                                           |
| [Sentinel](/any-guardrail/api-reference/index/prompt-injection/sentinel.md)                         | Binary prompt-injection classifier.                                                                            |
| [SusFactor](/any-guardrail/api-reference/index/prompt-injection/susfactor.md)                       | Binary prompt-injection and jailbreak classifier using a chunked e5-large encoder with a trained MLP head.     |

## Content Safety

| Guardrail                                                                                               | Description                                                                                                            |
| ------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
| [Alinia](/any-guardrail/api-reference/index/content-safety/alinia.md)                                   | Hosted content-moderation and safety-detection API with configurable detection policies.                               |
| [Azure Content Safety](/any-guardrail/api-reference/index/content-safety/azure-content-safety.md)       | Hosted moderation of text and images across hate, sexual, self-harm, and violence categories with 0-7 severity scores. |
| [Bedrock Guardrails](/any-guardrail/api-reference/index/content-safety/bedrock-guardrails.md)           | Hosted, configurable moderation covering content filters, denied topics, PII, word filters, and contextual grounding.  |
| [Bielik Guard](/any-guardrail/api-reference/index/content-safety/bielik-guard.md)                       | Polish multi-label safety classifier.                                                                                  |
| [DuoGuard](/any-guardrail/api-reference/index/content-safety/duo-guard.md)                              | Multilingual multi-label safety classifier scoring text across 12 harm categories including jailbreak prompts.         |
| [GLiGuard](/any-guardrail/api-reference/index/content-safety/gli-guard.md)                              | Schema-driven safety, toxicity, jailbreak, and refusal detector.                                                       |
| [gpt-oss-safeguard](/any-guardrail/api-reference/index/content-safety/gpt-oss-safeguard.md)             | Policy-grounded reasoning safety classifier that judges text against a bring-your-own written policy.                  |
| [Kanana Safeguard](/any-guardrail/api-reference/index/content-safety/kanana-safeguard.md)               | Korean safety decoder models covering harmful content, legal risk, and prompt attacks.                                 |
| [Llama Guard](/any-guardrail/api-reference/index/content-safety/llama-guard.md)                         | Decoder-LLM safety classifier judging prompts and responses against the 14-category MLCommons hazard taxonomy.         |
| [Nemotron Content Safety](/any-guardrail/api-reference/index/content-safety/nemotron-content-safety.md) | Reasoning safety classifier covering a 22-category content-safety taxonomy.                                            |
| [OpenAI Moderation](/any-guardrail/api-reference/index/content-safety/openai-moderation.md)             | Hosted moderation API flagging content across 13 harm categories with calibrated scores.                               |
| [PolyGuard](/any-guardrail/api-reference/index/content-safety/poly-guard.md)                            | Multilingual safety-moderation judge reporting request harm, response harm, and refusal across 17 languages.           |
| [Qwen3Guard](/any-guardrail/api-reference/index/content-safety/qwen3-guard.md)                          | Generative safety moderation with three-level severity across 119 languages.                                           |
| [Qwen3Guard-Stream](/any-guardrail/api-reference/index/content-safety/qwen3-guard-stream.md)            | Token-level streaming safety moderation with span output.                                                              |
| [ShieldGemma](/any-guardrail/api-reference/index/content-safety/shield-gemma.md)                        | Policy-conditioned safety classifier that judges a prompt against a user-supplied policy via Yes/No token logits.      |
| [watsonx Guardian](/any-guardrail/api-reference/index/content-safety/watsonx-guardian.md)               | Hosted text-detection moderation API running configurable Granite Guardian detectors.                                  |
| [WildGuard](/any-guardrail/api-reference/index/content-safety/wild-guard.md)                            | One-pass safety-moderation judge reporting prompt harm, response harm, and refusal.                                    |

## PII

| Guardrail                                                            | Description                                                                           |
| -------------------------------------------------------------------- | ------------------------------------------------------------------------------------- |
| [GLiNER2 PII](/any-guardrail/api-reference/index/pii/gli-ner-pii.md) | Span-level PII/NER detector emitting character spans and a redacted copy of the text. |

## Hallucination

| Guardrail                                                                           | Description                                  |
| ----------------------------------------------------------------------------------- | -------------------------------------------- |
| [LettuceDetect](/any-guardrail/api-reference/index/hallucination/lettuce-detect.md) | Token/span-level RAG hallucination detector. |

## Off-Topic

| Guardrail                                                              | Description                                                                                 |
| ---------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- |
| [Off-Topic](/any-guardrail/api-reference/index/off-topic/off-topic.md) | Cross-encoder relevance detector that flags whether an input strays from a comparison text. |

## General Judge

| Guardrail                                                                                | Description                                                                                                                          |
| ---------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
| [AnyLlm](/any-guardrail/api-reference/index/general-judge/any-llm.md)                    | Policy-based LLM judge that grades text against a natural-language policy using an LLM provider.                                     |
| [CompassJudger](/any-guardrail/api-reference/index/general-judge/compass-judger.md)      | Generalist LLM judge that scores a response against user-defined criteria and rubric on a 1-10 scale.                                |
| [DynaGuard](/any-guardrail/api-reference/index/general-judge/dyna-guard.md)              | Dynamic guardian model evaluating conversation compliance with user-defined policies.                                                |
| [Flow Judge](/any-guardrail/api-reference/index/general-judge/flowjudge.md)              | Local LLM judge scoring text against user-defined criteria, metrics, and rubrics.                                                    |
| [GLIDER](/any-guardrail/api-reference/index/general-judge/glider.md)                     | Prompt-based LLM judge that grades text against user-supplied pass criteria and rubric, returning reasoning and highlighted phrases. |
| [Granite Guardian](/any-guardrail/api-reference/index/general-judge/granite-guardian.md) | Hybrid-thinking safety and judge model covering harm, RAG groundedness, and function-calling risks via bring-your-own-criteria.      |
| [Patronus](/any-guardrail/api-reference/index/general-judge/patronus.md)                 | Hosted evaluation API running configurable evaluators for hallucination, toxicity, PII, prompt injection, and custom judging.        |
| [Prometheus](/any-guardrail/api-reference/index/general-judge/prometheus.md)             | Open rubric-based LLM judge grading a response on a user-defined 1-5 rubric.                                                         |
| [Selene 1 Mini](/any-guardrail/api-reference/index/general-judge/selene.md)              | General-purpose LLM judge grading a response against a user-defined 1-5 rubric.                                                      |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.mozilla.ai/any-guardrail/api-reference/index.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.