How ruchikarom/llmsentry works
llmsentry is a prompt-injection firewall with two user-facing modes: a drop-in HTTP proxy and a library wrapper. In either mode, messages are scanned, risk-scored with provenance weighting, and compared with block/flag thresholds; the proxy rejects blocked requests or forwards allowed ones to Groq and exposes recent decisions. The README documents a broader set of detection signals than the sampled scanner excerpt shows, so signal families are represented at a high level. Proxy logging is in-memory, not a persistent store.
Main entry points: proxy.py HTTP proxy · scanner.py Message scanning · client.py Guarded client
Components 13
Entry points
- HTTP proxy
llmsentry/llmsentry/proxy.py - Guarded client
llmsentry/llmsentry/client.py
Scanning and decisions
- Message guard
llmsentry/llmsentry/client.py - Message scanning
llmsentry/llmsentry/scanner.py - Source provenance
llmsentry/llmsentry/scanner.py - Text signals
llmsentry/llmsentry/scanner.py - Agent action signals
llmsentry/llmsentry/scanner.py - Risk scoring
llmsentry/llmsentry/scanner.py - Threshold verdict
llmsentry/llmsentry/client.py
Proxy and state
- Recent decisions
llmsentry/llmsentry/proxy.py
Other components
- LLM application
- Groq API
- Operator
Connections 19
- LLM application → HTTP proxy: sends requests
- HTTP proxy → Message guard: checks messages
- LLM application → Guarded client: calls completions
- Guarded client → Message guard: checks messages
- Message guard → Message scanning: scans messages
- Message scanning → Source provenance: maps sources
- Message scanning → Text signals: checks content
- Message scanning → Agent action signals: checks actions
- Message scanning → Risk scoring: combines signal weights
- Source provenance → Risk scoring: weights by source
- Risk scoring → Threshold verdict: returns scores
- Message guard → Threshold verdict: applies thresholds
- Threshold verdict → HTTP proxy: returns verdict
- Threshold verdict → Guarded client: returns verdict
- HTTP proxy → Recent decisions: records decisions
- HTTP proxy → Groq API: forwards allowed requests
- Operator → HTTP proxy: checks health or log
- Recent decisions → HTTP proxy: supplies recent entries
- Guarded client → Groq API: forwards allowed calls