NeMo Guardrails

Summary

NeMo Guardrails is an open-source Python library, licensed under Apache 2.0, that adds programmable guardrails to LLM-based conversational applications to control outputs and block unsafe behavior. It's imported directly into an application's code, though it can also run as a standalone HTTP server exposing an OpenAI-compatible endpoint for checking inputs or outputs without generating a model response. It's built for developers building LLM applications who need to validate tool calls, screen retrieved content for context bloat, or detect and mask PII, using either local Hugging Face classifiers or integrations like Polygraf, rather than for security teams auditing systems after the fact. It sits in the LLM runtime-protection category, alongside the broader set of guardrail and content-filtering libraries developers reach for when wiring safety checks into a chat pipeline.

NeMo Guardrails is a framework that adds safety constraints and moderation to large language models to prevent harmful outputs.

Command line

Values are placeholders taken from each option’s declared default. Nothing is executed here — the output shown is a recording of a run that already happened.

Release history

1. v0.24.0 Aug 26, 2026 · issue 009

   NeMo Guardrails v0.24.0 adds RailOutcome, rail manifests, F5 integration, health endpoints, and expands IORails to 59 built-in rails.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v0.24.0 https://github.com/NVIDIA-NeMo/Guardrails.git
   # already have the repo? check out this version:
   $ git checkout v0.24.0

   └──▷ TRY IT
   Poll the new health endpoint to verify a running Guardrails server is ready before routing traffic.
   copy

   $ curl -s http://localhost:8000/v1/health

   Run output-rail checks against a server-loaded config by supplying config_id to /v1/checks.
   copy

   $ curl -s -X POST http://localhost:8000/v1/checks \
     -H 'Content-Type: application/json' \
     -d '{"config_id": "my-guardrails-config", "messages": [{"role": "assistant", "content": "Here is the answer."}]}'

   • ›Adds RailOutcome — an engine-neutral allow, block, or transform result that both LLMRails and IORails can enforce from a single rail action return value.
   • ›Adds typed rail manifests so built-in rails declare their configuration, actions, execution surfaces, requirements, and privacy properties for automatic discovery by both engines.
   • ›Adds /v1/health and /healthz server health-check endpoints.
   • ›Adds output-rail checking mode to the /v1/checks endpoint, which now selects a server-loaded configuration via config_id or the server default.
   • ›Adds F5 Guardrails integration as a new built-in library rail.
   +5 moreshow less

   • ›Adds a canonical outbound HTTP client shared by all built-in integrations, providing connection pooling, retries, TLS, error handling, lifecycle management, and privacy-safe tracing and metrics.
   • ›Adds shared model telemetry and an instrumented model decorator for LLM call observability.
   • ›Expands IORails to execute 59 of the library's 67 action-backed input and output surfaces, including community integrations and content-transforming rails, sharing the same rail implementations as LLMRails.
   • ›Supports running multiple self-check rails simultaneously with per-rail namespaced task prompts.
   • ›IORails now returns GenerationResponse from non-streaming generate() and generate_async() calls when generation options are supplied.
   └──▷ BREAKING ON UPGRADE

   • !Custom actions using @action(output_mapping=...) must remove that argument and return an explicit RailOutcome instead.
   • !The hf-classifier install extra is removed; install transformers and torch directly for the local classifier backend.
   • !IORails generate() and generate_async() calls that supply generation options now return GenerationResponse; message lists must be passed with messages= as a keyword argument rather than positionally.
   • !Custom Colang 1 flows using the former space-separated Cleanlab, Fiddler, or GCP action names must switch to their snake_case names.
   • !/v1/checks no longer accepts inline configuration; select a server-loaded configuration using config_id or rely on the server default.
   • !Chat Completions requests must use supported role-specific OpenAI message shapes; internal event payloads, unexpected fields, and audio requests are now rejected.