Skip to content
SPECIFICTION
Get listed

NVIDIA NeMo Guardrails

developer.nvidia.com

Free plan Open source WindowsmacOSLinuxAPISelf-hosted
Visit developer.nvidia.com
Spec score 8.6 #4 of 31 in LLM Security Tools

What it is

NVIDIA NeMo Guardrails is an open-source Python package for adding programmable policy and safety checks to applications built with large language models. It can block, alter, or validate inputs and model responses that are unsafe, off-topic, malicious, or against configured policies. Its rails cover input, retrieval, dialog, execution, and output stages. Developers can configure behavior with YAML files, Colang flows, built-in guardrails, and custom actions. The catalog includes content safety, jailbreak protection, topic control, PII detection, agentic security, tool calling, hallucination and fact-checking, and model self-checks. Applications can use the Python SDK or a Guardrails server with HTTP endpoints such as OpenAI-style chat completions. The library supports Windows, Linux, and macOS, and can run in a self-managed Python environment. The installation guide lists Python 3.10 through 3.13 and at least one CPU with 4GB RAM; external models may require separately deployed GPUs. The open-source library costs nothing, though external models and services may need separate setup. NVIDIA cautions that no single rail covers every adversarial prompt and advises defense in depth and evaluation.

Spec sheet

What it does
NeMo Guardrails is an open-source Python package that intercepts LLM inputs and outputs and applies programmable policies to block, modify or validate content.Read 15 Oct 2026 · docs.nvidia.com
Purpose
NeMo Guardrails is an open-source Python package for adding programmable guardrails to LLM-based applications.Read 9 Oct 2026 · docs.nvidia.com
Intended users
The library is presented for developers and teams building LLM applications who need configurable policy enforcement and safety checks.Read 9 Oct 2026 · docs.nvidia.com
Deployment
The library can run in a self-managed Python environment, while the separate NeMo Guardrails microservice uses a container image and Kubernetes with Helm.Read 9 Oct 2026 · docs.nvidia.com
Integrations
The documentation lists integrations with NVIDIA safety models, community models, third-party APIs, Python actions, and LangChain tools.Read 9 Oct 2026 · docs.nvidia.com
License
The NeMo Guardrails library is licensed under the Apache License 2.0.Read 15 Oct 2026 · github.com
Headquarters
Santa Clara, California, United StatesRead 23 Sep 2026 · developer.nvidia.com
Founded
1993Read 23 Sep 2026 · developer.nvidia.com
Agentic security
Tool-call validation, execution rails, LangGraph integration and action monitoring are provided for agent workflows.Read 15 Oct 2026 · docs.nvidia.com
Build endpoint limitation
The project states that NVIDIA Build is intended only for evaluation and testing and should not receive confidential or personal data.Read 15 Oct 2026 · github.com
CLI
The package includes a nemoguardrails command-line interface with chat, server, actions-server and evaluation commands.Read 15 Oct 2026 · github.com
Company profile
LinkedIn lists NVIDIA as a public computer-hardware company headquartered in Santa Clara, California, with 10,001+ employees and founded in 1993.Read 15 Oct 2026 · linkedin.com
Configuration
Guardrails can be configured with YAML files, Colang flows, built-in guardrails, and custom actions.Read 9 Oct 2026 · docs.nvidia.com
Content safety
The library supports content-safety checks using LLM self-checks, NVIDIA safety models, community models and third-party moderation APIs.Read 15 Oct 2026 · docs.nvidia.com
Controls
It can block, alter, or validate unsafe, off-topic, malicious, or policy-violating inputs and model responses.Read 9 Oct 2026 · docs.nvidia.com
Deployment options
The same YAML and Colang configurations can run in a self-managed Python environment, Docker, or the Kubernetes-based microservice.Read 15 Oct 2026 · docs.nvidia.com
Documentation depth
The documentation covers installation, configuration, Colang, APIs, evaluation, vulnerability scanning, observability, Docker, microservices, troubleshooting and security.Read 15 Oct 2026 · docs.nvidia.com
Framework integrations
Official documentation lists integrations for LangChain, LangGraph and LlamaIndex, plus third-party moderation and validation APIs.Read 15 Oct 2026 · developer.nvidia.com
Frameworks
Framework integrations include LangChain and LangGraph, with LangGraph agent workflow support requiring the LangChain opt-in and matching packages.Read 9 Oct 2026 · docs.nvidia.com
GPU requirement
The core library runs on CPU, while external models connected to it may require separately deployed GPUs.Read 15 Oct 2026 · docs.nvidia.com
HTTP API
The Guardrails server exposes OpenAI-style /v1/chat/completions endpoints through a local FastAPI service.Read 15 Oct 2026 · docs.nvidia.com
Installation
The documented installation command is pip install nemoguardrails, with source installation available from GitHub.Read 15 Oct 2026 · docs.nvidia.com
Interfaces
Applications can use the Python SDK or a Guardrails server that exposes HTTP endpoints such as OpenAI-style chat completions.Read 9 Oct 2026 · docs.nvidia.com
Jailbreak protection
Jailbreak defenses include LLM self-checking, heuristic detection, NVIDIA NemoGuard NIM and third-party security integrations.Read 15 Oct 2026 · docs.nvidia.com
Limit: documentation and maturity
G2 feedback cites documentation gaps for indexing and deployment, limited community support, early-stage maturity and substantial memory needs.Read 15 Oct 2026 · g2.com
Microservice lifecycle
The NGC page says NeMo microservices were sunset on October 1, 2026 and will receive no new releases.Read 15 Oct 2026 · catalog.ngc.nvidia.com
Multimodal safety
Documentation includes a multimodal content-safety tutorial and guardrail catalog entry.Read 15 Oct 2026 · docs.nvidia.com
Operating systems
The installation guide lists Windows, Linux, and macOS as supported operating systems.Read 9 Oct 2026 · docs.nvidia.com
PII and logs
PII rails do not automatically sanitize every application log or external telemetry backend, so logging and retention controls must be configured separately.Read 9 Oct 2026 · docs.nvidia.com
PII detection
PII can be detected and blocked or masked using GLiNER, Microsoft Presidio, Private AI, Polygraf, AutoAlign and GuardrailsAI validators.Read 15 Oct 2026 · docs.nvidia.com
Policy configuration
Guardrails are configured with YAML files and Colang conversational flows, with Python custom actions for application-specific logic.Read 15 Oct 2026 · docs.nvidia.com
Praise: performance and flexibility
G2 reviewers praise unified training/deployment workflows, GPU performance, broad NLP and speech capabilities, and flexibility for conversational AI and RAG.Read 15 Oct 2026 · g2.com
Python SDK
Applications can use the LLMRails and RailsConfig Python APIs, including synchronous and asynchronous generation methods.Read 15 Oct 2026 · docs.nvidia.com
RAG grounding
The toolkit supports retrieval, fact-checking and hallucination rails for retrieval-augmented generation applications.Read 15 Oct 2026 · github.com
Rail stages
The library provides input, retrieval, dialog, execution, and output rails for different stages of an LLM interaction.Read 9 Oct 2026 · docs.nvidia.com
Rating on G2
4.3 out of 5 from 4 reviewsRead 15 Oct 2026 · g2.com
Rating on Gartner Peer Insights
4.5 out of 5 from 211 NVIDIA vendor reviewsRead 15 Oct 2026 · gartner.com
Rating on GetApp
0 out of 5 from 0 reviewsRead 15 Oct 2026 · getapp.com
Rating on Software Advice
No reviews yet; pricing is available upon requestRead 15 Oct 2026 · softwareadvice.com
Release status
The repository identifies version 0.23.0 as the latest released version while the develop branch tracks ongoing development.Read 15 Oct 2026 · github.com
Repository activity
The public GitHub repository shows about 7.0k stars and 812 forks.Read 15 Oct 2026 · github.com
Runtime requirements
The installation guide lists Python 3.10 through 3.13 and a minimum of one CPU with 4GB RAM; external models may require separately deployed GPUs.Read 9 Oct 2026 · docs.nvidia.com
Safety capabilities
The guardrail catalog includes content safety, jailbreak protection, topic control, PII detection, agentic security, tool calling, hallucination and fact-checking, and LLM self-checks.Read 9 Oct 2026 · docs.nvidia.com
Security guidance
NVIDIA advises treating LLM-generated content as untrusted, using allow-lists where possible, and isolating authentication information from the LLM.Read 9 Oct 2026 · docs.nvidia.com
Security limits
NVIDIA says no single rail guarantees protection against every adversarial prompt and recommends defense in depth and evaluation of bypasses and false positives.Read 9 Oct 2026 · docs.nvidia.com
Supported models
The project documents use with OpenAI GPT-3.5/GPT-4, Llama 2, Falcon, Vicuna and Mosaic models, among others.Read 15 Oct 2026 · github.com
System requirements
The current installation guide supports Windows, Linux and macOS, Python 3.10 through 3.13, and a minimum of one CPU with 4GB RAM.Read 15 Oct 2026 · docs.nvidia.com
Telemetry
The library emits anonymous usage events and heartbeats by default and provides environment-variable and file-based opt-out controls.Read 15 Oct 2026 · github.com
Topic control
Topic rails and Colang flows can constrain conversations to predefined subject areas, with NVIDIA topic-control models available as an integration.Read 15 Oct 2026 · docs.nvidia.com

Plans and prices

Open-source NeMo Guardrails library Free Open-source Python package; external models and services may require separate setup Read 9 Oct 2026 · docs.nvidia.com
Open-source NeMo Guardrails library Free Free access for research, development and testing Python package · self-managed deployment · external model/API costs may apply Read 15 Oct 2026 · developer.nvidia.com
NeMo Guardrails microservice Priced on request Production use requires an NVIDIA AI Enterprise License Helm/container deployment · production licensing required Read 15 Oct 2026 · catalog.ngc.nvidia.com

Every NVIDIA NeMo Guardrails plan and price →

Strong points and limits

Strong points

  • Provides input, retrieval, dialog, execution, and output rails
  • Supports YAML, Colang flows, and custom actions
  • Offers a Python SDK and HTTP server interface
  • Runs on Windows, Linux, and macOS

Limits

  • External models and services may require separate setup
  • External models may require separately deployed GPUs
  • Rails do not guarantee protection from every adversarial prompt

Who it suits

NeMo Guardrails suits developers and teams building LLM applications that need configurable policy enforcement and safety checks. It requires a Python environment and may depend on separately deployed external models.

NVIDIA NeMo Guardrails in depth

Read the full write-up

NVIDIA NeMo Guardrails is a free, open-source Python package for adding policy and safety checks to LLM applications. It is best suited to developers and teams prepared to configure and operate those checks in an application they manage. Its staged controls are flexible; adopting them still requires engineering, evaluation, and separate attention to application security.

Overview

The library can block, alter, or validate unsafe, off-topic, malicious, or policy-violating inputs and model responses. Its five rail stages—input, retrieval, dialog, execution, and output—let a team enforce policy at different points in an interaction, rather than treating the final response as the only control point. That flexibility is useful for applications with distinct risks at different stages, but teams must decide where checks belong and assess how they behave.

Configuration combines YAML files, Colang flows, built-in guardrails, and custom actions. The catalog covers content safety, jailbreak protection, topic control, PII detection, agentic security, tool calling, hallucination and fact-checking, and LLM self-checks. This range supports varied policies; it is not a promise that every risk is covered automatically.

Key features

Integration and interfaces

Teams can connect NVIDIA safety models, community models, third-party APIs, Python actions, and LangChain tools. Framework integrations include LangChain and LangGraph, although LangGraph agent workflow support requires the LangChain opt-in and matching packages. Applications can use the Python SDK or a Guardrails server, which exposes HTTP endpoints including OpenAI-style chat completions. These options suit teams integrating guardrails into an existing Python or framework-based application, but they require implementation work rather than offering a standalone policy service.

Deployment and safeguards

The library runs in a self-managed Python environment. A separate NeMo Guardrails microservice uses a container image and Kubernetes with Helm. Installation supports Windows, Linux, and macOS, with Python 3.10 through 3.13 and a minimum of one CPU and 4GB RAM; external models may need separately deployed GPUs. That makes the base package feasible to run on modest CPU resources, while model choices can add infrastructure requirements.

NVIDIA recommends treating generated content as untrusted, using allow-lists where possible, and keeping authentication information isolated from the LLM. It also warns that no single rail protects against every adversarial prompt, and recommends defense in depth plus evaluation for bypasses and false positives. PII rails do not automatically sanitize all application logs or external telemetry, so logging and retention controls remain the operator's responsibility.

Pricing

Open-source NeMo Guardrails library: free. The plan provides the open-source Python package for self-hosted use, with prompt injection defense, PII redaction, and output guardrails. External models and services may require separate setup. This is a strong fit for teams able to supply their own environment and integration work; it is less suitable for buyers seeking a managed service or a packaged deployment without operational responsibility.

Platforms

NeMo Guardrails supports API use and self-hosting, and its installation guide supports Windows, Linux, and macOS. The package requires Python 3.10–3.13 and at least one CPU with 4GB RAM; external models may require separately deployed GPUs. Its deployment path is therefore best aligned with teams able to manage a Python environment, or Kubernetes when using the separate microservice.

Who it's for

This is for developers and teams building LLM applications that need configurable policy enforcement and safety checks. It is particularly appropriate when controls must span inputs, retrieval, tool or execution steps, and outputs, and when the team can configure rails and evaluate their results. Teams wanting protection without application-level integration, deployment, and logging decisions should look elsewhere.

Pros and cons

Pros: Five rail stages allow checks across an interaction, not just at response time.

Pros: YAML, Colang, built-in guardrails, and custom actions give developers multiple ways to express policies.

Pros: The open-source package is free and can run in a self-managed Python environment.

Cons: The breadth of controls does not remove the need to configure policies and test for bypasses and false positives.

Cons: PII controls do not cover every log or telemetry backend; operators must configure retention and logging separately.

Cons: External models may need separate GPU deployment, adding infrastructure beyond the package's minimum CPU requirements.

Alternatives

For a metered API with a stated free allowance, consider Prompt Inspector: its free plan includes 1,000 detections per month with a REST API, SDK, and MCP. PromptGuard may suit teams seeking a freemium scan service; its free plan caps usage at 20,000 scans a month, one API key, and one project, with 24-hour log retention, while Team costs $19 a month.

GuardionAI is a paid alternative with a free trial and a custom-contract Enterprise plan. Sanctum Runtime is another freemium option; its documentation describes an MIT-licensed, open-core product. Amazon Bedrock Guardrails is a paid alternative with web support and separately priced content-filter and denied-topic options. VotalAI is a paid option with a free plan and free trial. Inferwall is a free option supporting API and desktop operating systems. Openlayer Guardrails is freemium, with its Basic plan including one member, five projects, 20,000 inference logs per month, and three months of data retention.

Browse LLM Security Tools or AI Guardrail Software for more options.

Verdict

Choose NeMo Guardrails if you are building an LLM application you can operate and want free, configurable checks across multiple interaction stages. Its main advantage is the breadth and placement of its controls; its main drawback is that configuration, evaluation, infrastructure, and safeguards beyond the rails remain your responsibility.

Verdict

NeMo Guardrails offers configurable checks across several stages of an LLM interaction. Its guidance calls for additional safeguards and evaluation, since no single rail handles every adversarial prompt.

Where Specifiction places it

Alternatives to NVIDIA NeMo GuardrailsAll alternatives →