Built-in validators: the Guardrails AI validators ported natively

[architsharm]

Built-in validators, ported from Guardrails AI

About seventy Guardrails AI validators are now native code in src/agentfox/capabilities/detection/validators/. None needs the guardrails package or a per-validator pip install. Every source repository is Apache-2.0; credit is in THIRD_PARTY_NOTICES.md and in each class's upstream, and the licence text is in validators/LICENSE-guardrails-ai. Nothing was taken from the unlicensed hub monorepo.

How it fits

• One small interface (validators/base.py): name, entity type in our taxonomy, surfaces, a pydantic settings schema, and check(text, params, ctx). Validators sit in a registry. Outside packages add their own through the agentfox.validators entry point.

• No settings needed: a validator can run as a validator.<name> detector, which gives it budgets, obfuscation views, tuning and the Checks screen.

• Settings needed (system prompt, column list, word list): it runs as a custom rule of kind validator through the new custom.validators detector. The rule is watched, enforced, simulated and tuned like any other. A request gets a larger budget only when a rule that needs one applies.

• Three kinds of check:

  Kind	How it runs
  rule	offline
  model	local weights, never downloaded during a request
  judge	through the judgment tier, which owns egress and redaction

  A judge that cannot answer raises an error. It never returns clean.

The ports

Module	Validators
text	regex_match, contains_string, ends_with, casing, one_line, two_words, valid_length/choice/range, reading_time/level, redundant_sentences, cucumber
structure	valid_json, valid_python, valid_url, has_url, valid_html, valid_open_api_spec, valid_address, endpoint_is_reachable (the last two gated on allow_egress)
sql	valid_sql, exclude_sql_predicates, sql_column_presence
web / disclosure	web_sanitization (XSS), internal_domains, system_prompt_leak
lists	ban_list (fuzzy, word-boundary), mentions_drugs, quotes_price, competitor_check, secrets_present
models	detect_jailbreak, toxic_language, bert_toxic, nsfw_text, bias_check, gibberish_text, financial_tone, profanity_free, restrict_to_topic, sensitive_topics, similarity/provenance, GLiNER/Presidio PII, translation quality, Llama Guard / ShieldGemma (run locally, licence-gated)
judges	llm_critic, response_evaluator, relevance, responsiveness, politeness, logic, persona, saliency, RAG hallucination/correctness/retrieval, toxic_language_llm, unusual_prompt, prompt_injection_llm, provenance_llm, wiki_provenance

Upstream bugs fixed along the way, each noted in the code:

• ends_with compared only the last character.
• valid_json rejected 0, false and [].
• ban_list spans were off by one.
• mentions_drugs never matched names of more than one word.
• competitor_check matched inside longer words.
• internal_domains matched raw substrings.

Ours, theirs or both

benchmarks/validators/ scores each component once on held-out data, then computes the unions from those predictions. The numbers choose defaults only; they are never used to edit a pattern.

	Recall	False positives
Injection: injection.classifier (ours)	95.3%	23.2%
+ detect_jailbreak (theirs)	95.8%	26.3%
Toxicity: safety.lexicon (ours)	3.5%	0.0%
+ bert_toxic (theirs)	28.2%	1.2%
nsfw_text (theirs)	87.3%	20.6%

• bert_toxic is now offered as an every-request check.
• nsfw_text is available only as a rule.
• Their jailbreak classifier is not added to ours. It is offered as the lighter option, because it more than doubles what our heuristic catches alone.

The ToxicChat data is CC-BY-NC: it is downloaded to var/ at run time and never committed.

Also

• Dashboard: Policies → Add rule → Use a built-in check. The settings form is drawn from each validator's schema; "Try it" runs it on a sample; editing a saved rule keeps its settings.
• Importer: a Guardrails AI guard maps each validator onto its port, with the same settings and on_fail. ValidLength, RegexMatch and others now import instead of being skipped.
• rails.hub.* (one pip install per validator) is removed. rails.guardrails_ai stays for running your own Guard.
• Fixed: the dashboard proxy dropped condition and tool, so value checks could not be saved from the dashboard.

Checks

• Full suite passes, and validator tests pass (220).
• ruff, import-linter (6 contracts, including a new one: built-in validators are reached through the registry), tsc, vitest 91/91, and the claims checker 46/46 all pass.
• Checked in the browser: picking a built-in check, trying it on a sample, saving it, and editing it again.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
guardrails-api	Ready	Preview	Oct 12, 2026 12:03pm UTC
guardrails-dashboard	Ready	Preview	Oct 12, 2026 12:03pm UTC
guardrails-redteam-lang	Ready	Preview	Oct 12, 2026 12:03pm UTC