LLM Guard Review (2026)
Protect AI's widely used open-source guardrails toolkit, archived on 9 July 2026 - roughly a year after Palo Alto Networks acquired the company. The MIT code survives, but the detection models are no longer maintained, which matters more for a guardrail than for anything else.
Rating
Starting Price
$0 (archived)
Free Plan
Yes
SDKs & Frameworks
2
Deployment
2
Best For
Nobody adopting fresh. Existing users should plan a migration. The code remains a reasonable reference implementation or fork base for teams that will own it.
Last Updated:
10 Things You Should Know About LLM Guard
- 1 The repository was archived by the owner on 9 July 2026 and is now read-only
- 2 The archival notice states the project and its associated Hugging Face models are no longer under active development or maintained
- 3 Licensed MIT, with roughly 3,200 GitHub stars and 518 commits on main
- 4 Palo Alto Networks completed its acquisition of Protect AI on 22 July 2025
- 5 The acquisition was announced on 28 April 2025, with reported values between $500 million and $700 million
- 6 Protect AI's technology and team were positioned as a cornerstone of Palo Alto's Prisma AIRS platform
- 7 No successor or migration guidance is published in the archived repository
Pros & Cons
Pros
- ✓ MIT licensed, so the code remains permanently usable and forkable
- ✓ Ran entirely self-hosted with no external API calls, meaning prompts never left your environment
- ✓ The scanner architecture was clean and composable, and remains a good reference implementation
- ✓ Genuinely popular, at roughly 3,200 stars, so there is a real community that may fork it
Cons
- ✕ Archived on 9 July 2026 and read-only - no further development
- ✕ The associated Hugging Face detection models are also explicitly unmaintained
- ✕ A frozen guardrail degrades silently as attack techniques evolve, which is worse than a frozen logging library
- ✕ No successor or migration path published in the repository
- ✕ The archival came roughly a year after Palo Alto Networks acquired Protect AI, and the capability now lives inside Prisma AIRS
Features
Archived on 9 July 2026
The repository is read-only, carrying an explicit notice:
THIS PROJECT HAS BEEN ARCHIVED. This project and its associated models on Hugging Face are no longer under active development or maintained.
That is a clear statement from the maintainer rather than something inferred from a quiet commit history, which makes it more definitive than most abandonments. It is also very recent - three weeks before this review - so comparison articles and directory listings will not reflect it for some time.
If you are running LLM Guard in production, this page is the notice you may not have received.
Why an archived guardrail is a different problem
This deserves its own section, because the instinct with abandoned MIT-licensed software is “it still works, we’ll deal with it later.”
For a guardrail, that instinct is wrong, and the reason is that the failure is silent and the domain is adversarial.
If an archived logging library breaks, you notice - logs stop appearing. If an archived guardrail stops being effective, nothing appears to change. It keeps running. It keeps returning confident passes. Your dashboards stay green.
Meanwhile prompt injection is an actively researched area where new bypasses appear constantly. A detector frozen in July 2026 degrades continuously against a threat that does not stand still. What you retain is the appearance of protection with steadily declining substance, and no signal anywhere in your monitoring will tell you it is happening.
That is why migrating off this is a security task with a deadline, not a maintenance item for the backlog.
The archival notice explicitly covers the Hugging Face models as well as the code, which is the more consequential half - the models are the detection.
What happened
| Date | Event |
|---|---|
| 28 April 2025 | Palo Alto Networks announces intent to acquire Protect AI |
| 22 July 2025 | Acquisition completed; reported at $500M–$700M, terms undisclosed |
| — | Protect AI’s technology and team become a cornerstone of Prisma AIRS |
| 9 July 2026 | LLM Guard archived |
Roughly a year from close to archival.
We are not asserting a causal link - the repository gives no reason and we found no statement explaining the decision. But the sequence matches a pattern this site has now documented many times over: the commercial capability continues inside the acquirer’s platform while the free open-source version stops.
What it was good at
Worth recording, because one property in particular is hard to replace.
LLM Guard provided composable input and output scanners - prompt injection detection, PII detection and anonymisation, toxicity, bias and topic filtering. Roughly 3,200 stars and 518 commits, MIT licensed.
The architecturally valuable part was that it ran entirely self-hosted with no external API calls. Your prompts never left your infrastructure. For regulated environments, that is a genuinely different proposition from a managed detection API, and it is the reason a lot of teams chose it over Lakera.
The scanner architecture was clean and remains a reasonable reference implementation.
Can you fork it?
Legally, yes. MIT, nothing withdrawn, fork and deploy commercially with essentially no obligations.
Practically, forking a guardrail means owning the detection models, and that is the hard part. Keeping a prompt injection detector current requires continuously gathering new adversarial examples and retraining - which is exactly the problem Lakera solved by building a public game that has collected 80 million attack attempts.
Unless you have a security team that will genuinely own that ongoing work, a fork gives you a decaying asset rather than a free tool.
What to migrate to
- NVIDIA NeMo Guardrails - Apache 2.0, actively developed, and backed by a maintainer with no runway risk. The closest replacement if you valued running self-hosted with no external calls.
- Guardrails AI - the other serious open-source option, complementary to NeMo with an official integration.
- Lakera - strongest managed detection with current models, but proprietary and now sold through Check Point.
The lesson worth taking
An open-source project inside an acquired company is a dependency with a hidden clock on it.
Helicone into maintenance mode after Mintlify. Traceloop’s platform absorbed by ServiceNow. promptfoo into OpenAI. Lakera into Check Point. CalypsoAI into F5. Now LLM Guard archived a year after Palo Alto bought Protect AI.
The permissive licence protects your right to the code. It protects nothing about whether anyone keeps improving it. For a guardrail - where the value lives in continuously updated detection rather than in the source - that distinction is the entire thing.
Should you use it?
No. It is archived, and for this category that is disqualifying rather than inconvenient.
If you are running it, treat migration as security work with a deadline.
Bottom line: a good tool that stopped three weeks ago, with a licence that keeps the code alive and a maintenance status that makes the code the least valuable part of it.
Archival status, date, licence and repository metrics verified directly against the GitHub repository on 3 August 2026. Acquisition dates verified against Palo Alto Networks’ own press releases; deal value is reported rather than disclosed. No reason for the archival is published, and no causal link to the acquisition is asserted here. This is a researched directory entry - we have not instrumented this tool with our reference application.
Pricing Plans
Open source (archived)
$0
- MIT licensed, code remains available and forkable
- Repository archived and read-only since 9 July 2026
- Associated Hugging Face models no longer maintained
- No security patches, no new detections
SDKs & Frameworks
Deployment
Eval Methods
Status
Our Verdict
LLM Guard is archived and you should not adopt it. The repository was made read-only on 9 July 2026 with an explicit notice that the project and its associated Hugging Face models are no longer under active development or maintained. That happened roughly a year after Palo Alto Networks completed its acquisition of Protect AI in July 2025, and the capability now lives inside Prisma AIRS. Because it is MIT licensed the code remains usable and forkable, which is a better outcome than a closed-source shutdown. But an archived guardrail is a worse proposition than an archived library of most other kinds, and this is the part worth understanding. Adversarial techniques evolve continuously. A frozen detector does not stop working in an obvious way - it keeps returning confident passes while missing attacks invented after it stopped being updated. You get the appearance of protection with steadily declining substance, and nothing in your monitoring will tell you. If you are running LLM Guard today, treat migration as a security task rather than a maintenance one.
Similar Tools
Arthur
Teams that want open-source guardrails running inside their own stack with the option of an inexpensive managed tier, and who value published pricing and unlimited seats.
Fiddler AI
Regulated enterprises that need guardrails running inside their own environment, particularly those already running predictive ML alongside LLM systems, and who can work with enterprise procurement.
Guardrails AI
Teams that want composable, permissively licensed output validation living next to their application code, especially those who prefer plain Python over a policy DSL.
HiddenLayer
Enterprises and government buyers who need model supply chain security, AI asset discovery and airgapped operation, rather than application-layer output filtering.
Frequently Asked Questions
Is LLM Guard really dead?
Yes, and unusually unambiguously. The repository was archived by the owner on 9 July 2026 and is read-only, carrying an explicit banner stating that the project and its associated models on Hugging Face are no longer under active development or maintained. That is a clear statement from the maintainer rather than an inference from commit history, which makes it more definitive than most of the abandonments we document. The archival is very recent, so most comparison content and directory listings will not reflect it yet.
Why is an archived guardrail worse than other archived software?
Because the failure is silent and the domain is adversarial. If an archived logging library breaks, you notice - logs stop appearing. If an archived guardrail stops being effective, nothing appears to change. It keeps running, keeps returning confident passes, and keeps producing green dashboards while missing attack techniques invented after development stopped. Prompt injection is an actively researched area where new bypasses appear constantly, so a detector frozen in July 2026 degrades continuously against a threat that does not. You retain the appearance of protection with steadily declining substance, and your monitoring will not tell you. That is why we treat this as a security issue rather than a maintenance one.
Can I still use the code?
Legally yes - it is MIT, so you can fork, modify and deploy it commercially with essentially no obligations, and nothing has been withdrawn. Practically, forking a guardrail means owning both the code and the detection models, and the models are the hard part. Keeping a prompt injection detector current means continuously gathering new adversarial examples and retraining, which is precisely the capability Lakera built an entire game around to solve. Unless you have a security team that will genuinely own that, a fork gives you a decaying asset rather than a free tool.
What happened with the Palo Alto acquisition?
Palo Alto Networks announced its intent to acquire Protect AI on 28 April 2025 and completed the acquisition on 22 July 2025, with reported values between $500 million and $700 million, though terms were not officially disclosed. Protect AI's technology and team became a cornerstone of Prisma AIRS, Palo Alto's AI security platform, and the CEO, founders and employees joined at closing. The open-source project was archived roughly a year later. We are not asserting a causal link, because we found no statement giving a reason, but the sequence is consistent with a pattern this site has documented repeatedly - the commercial capability continues inside the acquirer's platform while the free open-source version stops.
What should I migrate to?
For open source that is still maintained, NVIDIA NeMo Guardrails is Apache 2.0, actively developed, and has the additional advantage of a maintainer with no runway risk. Guardrails AI is the other serious open-source option and the two are complementary, with an official integration. If you want managed detection with current models, Lakera is the strongest, though it is proprietary and now sold through Check Point. If you were using LLM Guard specifically because it ran self-hosted with no external API calls, NeMo Guardrails is the closest replacement for that property.
What is the broader lesson here?
That an open-source project inside an acquired company is a dependency with a hidden clock on it. This site now documents Helicone into maintenance mode after Mintlify, Traceloop's platform absorbed by ServiceNow, promptfoo into OpenAI, Lakera into Check Point, CalypsoAI into F5, and now LLM Guard archived a year after Palo Alto bought Protect AI. The permissive licence protects your right to the code and protects nothing about whether anyone keeps improving it. For a guardrail, where the value is in continuously updated detection rather than in the code itself, that distinction is the whole thing.