---

Why AnveGuard

Most teams ship LLM features with no record of what was sent, what came back, or who could change the rules. AnveGuard slots in front of any LLM in 60 seconds and gives you the operational layer that's missing.

🔍 Full audit log Every prompt, response, token count, latency, model, status code, and admin action — searchable and exportable.	🧱 Layered policy engine Normalizer → patterns → heuristics → intent classifier. Block, flag, or sanitize before bytes leave your network.	🧠 Injection & jailbreak detection Battle-tested detectors for prompt injection, role-hijack, exfiltration, and risk-trio combos.
🔁 Multi-provider routing Fallback chains across OpenAI, Anthropic, Google, Perplexity, and custom OpenAI-compatible endpoints.	🏷️ Per-key model aliases Map fast, cheap, smart to whichever upstream model you want — swap providers without redeploying.	📈 Token-spike alerts Calibratable severity scoring catches runaway costs and abusive keys before they hit the bill.
🔐 Zero plaintext secrets AnveGuard keys SHA-256 hashed, upstream provider keys AES-GCM encrypted at rest.	⚡ <5 ms overhead Streaming responses are relayed without buffering. Your users won't notice the proxy is there.	🧰 Drop-in Change one base URL. No SDK upgrades, no wrappers, no application changes.

---

What's detected

AnveGuard ships 38 named injection patterns, 16 statistical detectors, and 9 channel-aware XPIA / indirect-injection rules out of the box — 63 distinct detection rules. Every one has unit tests in policy_engine_attacks.test.ts (130+ passing).

Family	Coverage
Direct prompt injection	ignore_prior_instructions, new_instructions_override, instructions_above_are_fake, role_reset, repeat_text_above, verbatim_initial_prompt, begin_with_system_prompt
Persona jailbreaks	DAN, AIM, BetterDAN, STAN, DUDE, Mongo Tom, Evil Confidant, Machiavelli, UCAR, EvilBOT, ChadGPT, Sydney 2.0, DAN 10+, plus generic act_as_unrestricted / pretend_no_restrictions / you_are_now_persona / two_responses_jailbreak
Narrative misdirection	Fictional / hypothetical / academic framing combined with harmful subjects, grandma trope, deceased-relative variants. Active and passive voice ("explains how X is synthesized")
Refusal suppression	refusal_suppression, answer_regardless, no_warnings_disclaimers, force_compliance_prefix ("start your response with 'Sure'")
Authority impersonation	False "I'm from OpenAI/Anthropic's safety team", policy_was_updated ("the new policy now allows X")
Skeleton Key (Microsoft 2024)	skeleton_key_update + skeleton_key_prefix_warning composite
Many-shot jailbreak (Anthropic 2024)	Detects role-marker alternations (Human:/Assistant: etc) embedded in single user messages — the MSJ signature
Unicode smuggling	Tag-character (CVE-2025-32711), zero-width, variation selectors, homoglyph (Cyrillic а / Greek ο masquerading as Latin)
Cipher attacks	ROT13/Caesar/Atbash mention + decode-and-execute, leetspeak density, Morse, Pig Latin
Adversarial suffix	GCG / AutoDAN-Turbo / BEAST trailing-garbage signatures (bracket clusters, mid-word case changes, gibberish tokens)
Chain-of-thought extraction	<thinking> / <scratchpad> reasoning leak probes (o1/Claude extended thinking)
Pseudo role tags	Fake [system], <|im_start|>, [INST] chat-template tokens injected into user content
System-role JSON	{"role":"system","content":"..."} pasted in user content
Encoded smuggling	Base64, hex, URL-encoded payload density (encoded_density); explicit decode-and-execute framing
Output guards	output_pii_leak (email, phone, SSN, credit-card, IP), output_repetition (Carlini divergence attack), system_prompt_leak (verbatim system-prompt slices), tool_injection (fabricated tool_calls JSON), credential_shape (sk-proj-, ag_live_, ghp_, AIza, stripe live/test, JWT, RSA private keys)
XPIA / indirect	New evaluateRetrieved() scanner — 9 channel-aware detectors for RAG chunks, MCP tool results, scraped HTML, email: instruction-override, imperative-to-model, markdown image exfil (EchoLeak), hidden HTML, HTML-comment injection, cross-tool reference (shadowing), SQL-write in NL→SQL context (Vanna.AI CVE-2024-5565), dangerous Python in code-gen retrieval (Langflow CVE-2025-3248), tag-char smuggling. Wired into the proxy's tool-result path.
Multi-turn behavioral	Gradual priming ("boil the frog"), trust-building, instruction-churn, persona-loading across turns
Risk-trio rule	Co-occurrence of (untrusted_input × outbound_channel × privileged_context) — the agentic exfiltration shape that matches the 2025 Supabase/Cursor/MCP-breach pattern
PII detection	Email, US phone, SSN, credit cards (with Luhn validation), IPv4/IPv6, OpenAI/Anthropic/AnveGuard keys, JWT — block/sanitize/flag configurable per workspace

Plus a layered multilingual keyword engine (fuzzy match + edit distance + semantic match) and a configurable intent classifier (LLM-backed, with shadow mode for low-friction rollout).

Mapped to standards: OWASP LLM Top 10 (2025), OWASP Agentic Top 10, OWASP MCP Top 10. CVE coverage includes CVE-2025-32711 (EchoLeak), CVE-2024-5565 (Vanna.AI), CVE-2025-3248 (Langflow), CVE-2024-7042 (LangChain).

---

The pipeline — every request, every stage

Prompt injection isn't the real problem. The real problem is what the model can do after compromise.

One pipeline runs in front of every model and every tool call. Each stage is independently configurable — and independently auditable.

        ┌────────────────────────────┐
        │        User input          │  from your app or agent
        └─────────────┬──────────────┘
                      ▼
        ┌────────────────────────────┐
        │      Prompt scanner        │  injection · PII · keyword · regex
        └─────────────┬──────────────┘
                      ▼
        ┌────────────────────────────┐
        │      Policy engine         │  per-key rules · intents · severity
        └─────────────┬──────────────┘
                      ▼
        ╔════════════════════════════╗
        ║  Tool permission layer     ║  shell · fs · net · sql · MCP
        ║   ← most teams skip this   ║
        ╚═════════════┬══════════════╝
                      ▼
        ┌────────────────────────────┐
        │            LLM             │  OpenAI · Anthropic · Google · custom
        └─────────────┬──────────────┘
                      ▼
        ┌────────────────────────────┐
        │      Output scanner        │  leak detection · response policy
        └─────────────┬──────────────┘
                      ▼
        ┌────────────────────────────┐
        │    Audit + telemetry       │  immutable log · alerts · webhooks
        └────────────────────────────┘

---

Threat scenarios — real attack paths, real blast radius

Detectors don't sell. Incidents do. Here's how AnveGuard interrupts three attack chains your team is already exposed to — most of which never touch a "prompt injection" classifier.

1. Indirect prompt injection via GitHub issue

Blast radius: Repo secrets · CI tokens · production credentials

GitHub issue contains hidden instructions
        ↓
Agent reads repository + .env secrets
        ↓
MCP tool executes privileged action
        ↓
Data exfiltrated to attacker domain
        ↓
✅ AnveGuard blocks tool call · policy violation

2. Customer-data exfiltration through a chat agent

Blast radius: PII · payment tokens · support transcripts

User pastes "summarize this and email it"
        ↓
Agent queries internal CRM via tool
        ↓
Model attempts outbound HTTP to unknown domain
        ↓
✅ AnveGuard denies — domain not on egress allowlist

3. Compromised model invokes destructive shell

Blast radius: Filesystem · DB rows · billing systems

Jailbreak bypasses model safety
        ↓
Model calls shell.exec("rm -rf /data")
        ↓
✅ Tool permission layer rejects · shell capability not granted
        ↓
✅ Audit log captures attempt + actor + payload

---

Tool governance — policy-controlled tool execution

Filters and detectors stop a fraction of the attack surface. The durable control is governing what an agent is allowed to do — which shells, which paths, which domains, which rows. AnveGuard treats every tool call (function call, MCP capability, shell command) as a permissioned action with its own allowlist, audit row, and override workflow.

Capability	What you can govern
Shell & code execution	Allowlist commands, deny by default, capture every invocation with arguments
Filesystem	Scope agents to specific paths, block writes outside a sandbox, deny secret reads
Outbound domains	Per-key egress allowlist — block exfiltration to unknown hosts before the request leaves
SQL & data access	Read-only roles, row-level scoping, refuse DDL and bulk SELECT from agent contexts
GitHub & MCP	Capability scoping for MCP servers — list which tools each key may invoke
Privileged actions	Require step-up approval for destructive ops: deletes, transfers, role grants

This is where the market is moving. Prompt detection commoditizes; runtime telemetry, policy orchestration, and execution governance are the durable moat.

---

Architecture

┌────────────┐  ag_live_*   ┌──────────────┐  provider key   ┌────────────┐
│  Your app  │ ───────────► │  AnveGuard   │ ──────────────► │  OpenAI    │
│ (any SDK)  │              │    proxy     │                 │  Anthropic │
└────────────┘              └──────┬───────┘                 │  Gemini    │
                                   │                         │  Perplexity│
                                   ▼                         │  Custom    │
                          policy · routing · logs            └────────────┘
                                   │
                                   ▼
                        ┌─────────────────────┐
                        │  Postgres (RLS)     │ ◄── React dashboard
                        │  request_logs, etc. │     (Clerk auth)
                        └─────────────────────┘

Edge function	Auth	Purpose
proxy	Bearer ag_live_*	OpenAI-compatible public endpoint, runs policy layers, forwards upstream, logs every call
dashboard	Clerk JWT	Action router for the React app: CRUD on keys, endpoints, policies, logs, routes
alerts-fire	cron	Evaluates anomaly rules every minute and emits webhooks

Shared modules live in supabase/functions/_shared: policy_engine.ts, anveguard.ts (key auth + AES-GCM + Clerk JWT verify), providers.ts, anthropic.ts, system_prompt.ts, compress.ts.

---

Quickstart — proxy your first request in 60 seconds

from openai import OpenAI

client = OpenAI(
    api_key="ag_live_…",                       # your AnveGuard key
    base_url="https://anveguard.app/v1",       # the only line that changes
)

resp = client.chat.completions.create(
    model="gpt-4o-mini",
    messages=[{"role": "user", "content": "Hello"}],
)

Every request now appears in the dashboard with status, latency, tokens, payloads, and policy verdicts.

---

Screenshots

A short tour of the surfaces you actually live in:

Observe & audit every call

Logs & audit — one row per request and one row per admin action. Status, model, provider, latency, tokens, block reason, full payloads — all queryable.

Token-spike alerts — scored 0–100 against a rolling baseline, with configurable thresholds, dampening, and email notifications.

Configure the rules that fire

Rule configuration — blocked + allowed keywords, custom block messages, the exact evaluation flow, and a sandbox to test before you ship.

Guardrails in action — keyword rules evaluated on input and output, with allowlist overrides and start-permissive-then-tighten tuning.

Predictable, OpenAI-shaped error responses

Error responses — full code table (blocked_input, blocked_output, invalid_api_key, upstream_rate_limited, upstream_timeout…) with explicit retry guidance.

Drop-in error shape — every error body matches OpenAI's, so existing try/except blocks and SDK error handlers keep working unchanged.

Providers, transport, and the rest

Endpoints & providers — OpenAI, Anthropic, Google, and any OpenAI-compatible upstream.

Proxy API — a strict subset of the OpenAI REST API. No SDK changes.

---

Discoverability — SEO & AI agents

AnveGuard is built to be found by both humans and machines.

Search engines (SEO)

• Per-page <title> / meta description / canonical / OpenGraph via the shared <Seo> helper
• Structured data (JSON-LD) for Organization, WebSite, FAQPage on the landing and /docs/faq route, and TechArticle on every /docs/* page
• public/sitemap.xml and public/robots.txt with explicit Allow for major crawlers

AI agents (AEO)

• public/llms.txt + public/llms-full.txt — concise and full-corpus summaries for LLM crawlers (Anthropic, OpenAI, Perplexity, Google-Extended)
• public/.well-known/llms.txt, public/ai.txt, public/ai-context.json — discoverability metadata
• public/.well-known/ai-plugin.json — OpenAI plugin manifest
• public/.well-known/agent-card.json — A2A / agent-card descriptor

---

Stack

• Frontend: Vite · React 18 · TypeScript · Tailwind · shadcn/Radix · TanStack Query · react-hook-form + zod · React Router 6
• Auth: Clerk — with a custom themed appearance (src/lib/clerk-appearance.ts) so SignIn/SignUp match the operator-console dark theme
• Backend: Supabase — Postgres + Deno Edge Functions
• Tests: Vitest (unit) · Deno (edge functions) · Playwright (e2e)

---

Local development

Prerequisites

• Node 22.x
• A free Supabase project
• A free Clerk application
• Deno CLI (for edge-function tests)

Setup

git clone https://github.com/ANVE-AI/prompt-sentinel-flow.git
cd prompt-sentinel-flow
npm ci
cp .env.example .env        # fill in VITE_SUPABASE_URL, VITE_SUPABASE_PUBLISHABLE_KEY, VITE_SUPABASE_PROJECT_ID
npm run dev                 # http://localhost:8080

Edge-function secrets (SUPABASE_SERVICE_ROLE_KEY, KEY_ENCRYPTION_SECRET, CLERK_JWKS_URL, provider keys) belong in your Supabase project, not in .env.

Quality gates

npm run lint          # ESLint
npm run typecheck     # tsc --noEmit
npm test              # Vitest unit tests
npm run build         # Production build
npm run e2e           # Playwright (needs e2e/.env.e2e — see e2e/README.md)

# Edge functions
cd supabase/functions
deno test --allow-env --allow-net --no-check

CI runs all of the above on every push and PR — see .github/workflows/ci.yml.

Database

29 forward-only migrations live in supabase/migrations.

supabase link --project-ref <your-project-ref>
supabase db push

Key tables: profiles, api_keys, endpoints, request_logs, policy_settings, policy_rules, policy_intents, routes, audit_logs, key_behavior_profiles. RLS is enabled on every table; the service role is the only accessor and all access goes through audited edge functions.

---

Deploying

supabase functions deploy proxy dashboard alerts-fire
supabase db push

The frontend is a plain Vite SPA — deploy the dist/ output to any static host (Vercel, Netlify, Cloudflare Pages, S3 + CloudFront, etc.).

---

Security model (one-page summary)

AnveGuard is multi-tenant. Isolation depends on three layers:

1. Auth at the edge. proxy validates Bearer ag_live_* against api_keys (SHA-256 hash compare). dashboard validates a Clerk JWT via JWKS.
2. Application-level row scoping. Every read in dashboard/index.ts filters by the authenticated clerk_user_id; CI grep-checks guard against missing .eq("user_id", …) clauses.
3. RLS as defense in depth. Every table denies anon/authenticated; only the service role can read or write.

Secrets: AnveGuard keys are SHA-256 hashed (never plaintext after creation). Upstream provider keys are AES-GCM encrypted with a key derived from KEY_ENCRYPTION_SECRET.

Found a vulnerability? See SECURITY.md — please don't open a public issue.

---

Roadmap

• Per-workspace key derivation for upstream credentials
• Metadata-only logging mode by default
• Self-hostable Docker distribution
• Spend caps & per-key budgets
• Streaming-aware output classification
• More built-in policy templates (PII, PCI, HIPAA, GDPR)

Track progress in GitHub Issues and grab anything tagged good-first-issue.

---

Contributing

PRs are very welcome — see CONTRIBUTING.md for the workflow, commit style, and pre-commit checklist. The active hardening roadmap is in the audit plan (issues C1-C5, H1-H11, M1-M11); pick an unclaimed item and reference its ID in your PR.

By participating you agree to be a decent human. Disagree with ideas, not people.

---

Documentation

In-app docs live at /docs/*:

Introduction	Guides	Reference
Overview	API Keys	Proxy API
Quickstart	Endpoints	Logs
Concepts	Routes	Errors
	Policies	FAQ

For maintainers: SECURITY.md, CONTRIBUTING.md.

---

License

Apache 2.0 — Copyright 2026 ANVE AI and AnveGuard contributors.

If AnveGuard saves you from a leaky prompt, an exploded token bill, or a 3am incident — drop us a ⭐ on GitHub. It's the cheapest way to support the project.