Type a command and the real engine answers, or read the recorded tour below. Either way: this is what happens when an agent — or a person — tries to run something dangerous behind Guardrail.
Guardrail classifies each tool call before it executes and returns one of three answers. There is no fourth case and no "probably fine".
The examples below use guardrail-exec, the wrapper that classifies a command and only then runs it. The same verdicts come back through the HTTP API, the Python SDK, and the MCP server — it is one engine underneath.
This one box is live. It sends what you type to the real Guardrail engine and shows you what came back. It classifies only — nothing you type is ever executed, here or anywhere else, and no account is involved.
Try to get something dangerous past it. Quoting, escaping, fullwidth characters, command substitution — the mapper normalizes before the rules run, so those are the interesting cases. Rate limited to 5 checks a second.
Everything below this point is recorded output, not a live call — a curated tour of what the engine does with commands worth seeing.
Everything guardrail-exec prints for a single blocked command. Nothing is trimmed here:
The command never ran. rm was never invoked — Guardrail decided before execution, and exited 126 so the calling script knows it was refused rather than that it failed. Tier: deterministic means no model was consulted: the answer came out of a compiled rule network in microseconds, and it will be the same answer every time.
Six more, abridged to the command and its reason. Each one is a full guardrail-exec run like the one above:
Note what these are: a shell pipe, a git flag, a permission bit, a Kubernetes verb, a Docker subcommand, and a line of SQL. Guardrail is not grepping for scary words — it parses each call into the same normalized form and runs one rule network over all of them. That is why ｒｍ －ｒｆ ／ in fullwidth characters is caught by the same rule as plain rm -rf.
Escalate is the answer for "this might be fine, but a human should look." The command is held, not refused:
pip install requests is almost certainly fine. It still escalates, because "install arbitrary code from the internet" is the category, and the category is what carries the risk — not the package name. Tier: fallback_escalate is the fail-safe: when no rule matches confidently, the answer is escalate, never allow. Unknown is never treated as safe.
The failure mode nobody talks about is a security layer that gets in the way often enough that people switch it off. Ordinary work is ordinary:
Allowed commands run normally — stdin, stdout, stderr, and the exit code all pass straight through, so guardrail-exec drops into an existing script without changing its behaviour. The two lines under each ALLOW above are the wrapped command's own output, not Guardrail's; the check adds one line and about 15µs.
Every verdict on this page came from the same public endpoint, which takes no key and no account. Paste this into a terminal:
curl -s -X POST https://guardrail.ellmstack.dev/api/upstream/check \
-H 'Content-Type: application/json' \
-d '{"tool_name":"bash","target":"rm -rf /tmp/build","params":{}}'
The real response, copied from that exact call:
{
"verdict": "deny",
"tier": "deterministic",
"action": "rm_rf",
"confidence": "high",
"strategy": "exact_command",
"reason": "rm with destructive flags",
"ellm_trace": ["rm_rf --rel225--> execution"],
"audit_chain_hash": "0ef34936140b89b9210c3f033de61566b4fc18eb04521586a473a4a4f46f6234",
"latencies": { "mapper_us": 49, "ellm_us": 84, "llm_us": 0, "total_us": 134 },
"service_wall_us": 165
}
Change target to anything you like — your own commands, or the ones above.
About that 134µs. The benchmark number we quote is 15µs p50: one engine, one dedicated core, measured in-process. This endpoint is a shared demo box with a proxy hop in front of it, so it reports higher and the figure moves call to call. Both numbers are real; they measure different things. The one you should plan capacity against is the one you reproduce on your own hardware.
The endpoint is rate limited to 5 requests per second per IP. It classifies only — it never executes what you send it — and because there is no key on the request, nothing you type here is attributed to an account. It does land in the demo engine's own audit log, so treat it as a public endpoint and don't paste anything sensitive into it.
Three different things, three different places. Pick the one you actually want:
Create an account, get an API key, connect a machine, and watch verdicts land in real time. Free tier is 8,000 checks a month, no card.
Open the console →curl -fsSL https://downloads.ellmstack.dev/install.sh | bash installs the CLI on macOS & Linux (x86_64 & arm64), then guardrail link pairs this machine. Self-hosters: run the full engine from the quickstart.
What each tier includes, what a check is, and where the limits sit. Free, Pro, and Team are self-serve; Enterprise is quoted.
See pricing →Guardrail is in beta: the engine is production-ready and the numbers on this page are reproducible, but the console is still changing week to week. If something here doesn't match what you see, tell us — that's the fastest way it gets fixed.