> ## Documentation Index > Fetch the complete documentation index at: https://docs.promptguard.co/llms.txt > Use this file to discover all available pages before exploring further. # Changelog > Release notes for PromptGuard — new detectors, SDK updates, API changes, and bug fixes, newest first. # Changelog Stay up to date with the latest changes to PromptGuard, including new features, improvements, and bug fixes. *** ## July 2026 - Enterprise self-host & multi-platform Shadow AI ### Air-gapped self-hosting (GA) * Run the entire engine inside your network with **zero egress**: Helm chart with a default-deny NetworkPolicy overlay, offline license verification (no phone-home in air-gap mode), and local ML inference on your GPUs * Direct OIDC SSO against your internal identity provider (Keycloak, AD FS, Okta on-prem) * A customer-verifiable no-egress audit document your security team can reproduce, plus SBOM and signed artifacts for supply-chain review ### Shadow AI on Windows and Linux (early access) * Windows x64 (.exe / .msi) and Linux x64 (.AppImage / .deb) installers are now publicly downloadable alongside the signed + notarized macOS universal app — [download](https://promptguard.co/download) * Windows installers are not yet code-signed (SmartScreen will warn); verify the SHA-256 checksums published with every release ### Shadow AI auto-update & fleet policy * Signed automatic updates with staged rollout, a remote kill-switch, and a server-set minimum-version floor — a dangerously outdated agent updates itself instead of running stale detection * In-app Settings: Automatic / Notify / Off modes and a beta channel * Fleet admins can force the update mode, pin the channel, and set a minimum version org-wide * Refreshed menu-bar app: protection state visible in the tray icon, full keyboard/VoiceOver accessibility, one-click recovery when HTTPS inspection needs approval ### ChatGPT MCP integration (GA) * The PromptGuard MCP server is live at `api.promptguard.co/mcp` (Streamable HTTP + OAuth 2.1) — connect it to ChatGPT or any MCP-capable client * The documentation itself is agent-readable: `docs.promptguard.co/mcp` and `/llms-full.txt` ## May 2026 - Shadow AI packaging * Personal Shadow AI is now included with **every** plan (protect one device on Free/Pro); the fleet layer (multi-device, org policy, usage rollup) unlocks at Scale * Standalone per-seat plans for Shadow-only customers went live (sales-led) *** ## April 2026 - Pricing update * **Pro** is now \*\*$99/month** (annual: $1,089) — same 100K requests / 5 projects / 7-day retention. * **Scale** is now \*\*$199/month** (annual: $2,189) — same 1M soft-limit / unlimited projects / 30-day retention. * **Free** and **Enterprise** are unchanged. * Existing subscribers stay on their original price (Stripe does not migrate active subscriptions). *** ## April 2026 - v3.3.0: ATR Integration, Agentic OWASP, Cisco Plugin * **Community rule pack** — Ingested 108 open-source rules / 714 regex patterns as a fast pre-filter layer covering agent-specific threats: MCP tool poisoning, cross-agent manipulation, skill supply chain attacks, privilege escalation, and excessive autonomy. PromptGuard now runs \~1,000+ detection patterns across built-in and community rule sets. * **OWASP Agentic Top 10 mapping** — Every security event now maps to both the **OWASP LLM Top 10** (LLM01–LLM10) and the **OWASP Agentic Top 10** (ASI01–ASI10). Full coverage for enterprise compliance reporting across both frameworks. * **External benchmark eval framework** — Added loaders for **PINT** (Invariant Labs, 850 adversarial samples) and **Garak** (NVIDIA, 666+ jailbreak probes) benchmarks for continuous validation using the existing eval runner. * **Scanner integration** — Thin API shim (`PromptGuardAnalyzer`) for contributing to open-source agent security scanners as an optional analysis backend. Zero detection logic shipped — all intelligence stays server-side. * **Detection strategy bug fix** — Fixed `FAST_FIRST` mode: non-detections from later providers no longer overwrite earlier detections, ensuring the first positive match is always preserved. *** ## March 2026 - v3.0: SOTA Detection Upgrade * **Content safety classification** — LLM-based harmful intent detection via an open-weight safety classifier, catching requests that traditional toxicity models miss (100% detection, 0% false positives) * **Multi-turn intent drift detection** — DeepContext-inspired crescendo attack detection using semantic embedding drift analysis with LLM verification * **Universal ML access** — All detection layers (ML ensemble, content safety, multi-turn analysis) now available on all plan tiers; pricing differentiates on usage volume only * **Six-layer detection architecture** — Upgraded from four layers to six: normalization → regex → ML ensemble → content safety → multi-turn drift → policy evaluation * **HIGHEST\_CONFIDENCE strategy** — Detection from any layer is sufficient to block; layers complement rather than gate each other *** ## March 2026 ### Dashboard Overhaul - CISO & ML Features * **Alerts Feed**: Real-time alert feed with severity filtering, status tracking, and unread count badge in the navigation bar * **Threat Intelligence**: Cross-tenant anonymized attack patterns, mutation strategy trends, and evasion rate analysis (Scale+) * **Audit Log**: Dedicated filterable audit log page with JSON export for SOC 2/GDPR compliance (Scale+) * **Webhook Delivery Monitoring**: Track delivery status, retry failed deliveries, and diagnose integration issues per project * **Detector Performance**: Per-detector accuracy, false positive rates, and latency metrics to help CISOs tune detection * **Token-Level Explainability**: Interaction detail pages now highlight which parts of a prompt triggered detection with confidence breakdowns * **Attack Drift Detection**: Visualize how attack patterns shift over time on the Threat Intelligence page * **Conversation-Level Threat View**: Group multi-turn interactions to detect escalation patterns across turns * **Security Cost Analysis**: ROI visualization showing latency cost vs. threats prevented in project analytics * **Feedback Impact**: See how your false positive/negative reports improve detection accuracy * **Compliance Reports**: Interactive framework-specific reports (SOC 2, GDPR, HIPAA, OWASP) with coverage progress bars * **Metrics Consistency**: Unified "Threats Flagged" metric (block + redact) across all dashboard pages - no more mismatched numbers * **Brand Refresh**: New deep indigo color identity with cool-tinted neutrals, unified chart color system, and View Transitions API for smooth page navigation * **URL State**: Interaction filters, search queries, and tab states are now bookmarkable and shareable * **Command Palette**: Enhanced ⌘K menu with "Jump to" shortcuts for Alerts, Threat Intelligence, and Audit Log * **Responsive Design**: Dashboard settings, compliance, and all new pages fully responsive for mobile and tablet ### OWASP LLM Top 10 Mapping * Every security event is automatically classified against the **OWASP LLM Top 10** framework with `owasp_id`, `cwe_id`, and human-readable title * Dashboard shows OWASP badges on event detail pages and an aggregate **OWASP Top 10 Coverage** chart on the project overview * Supports all 10 OWASP categories: LLM01 (Prompt Injection) through LLM09 (Misinformation), mapped from PromptGuard's native threat types ### AI-Generated Remediation Suggestions * Blocked and redacted events automatically receive **AI-generated security insights** using an open-source HuggingFace model (Qwen/Qwen3-4B) * Each insight includes a **summary**, **impact assessment**, and **actionable remediation steps** * Runs asynchronously in a background thread - adds zero latency to the request path * Displayed in the dashboard event detail as an "AI-Generated Insight" card ### Dashboard UX Enhancements * **Security Posture Card**: Project overview shows a data-driven circular gauge (0–100) reflecting guardrail coverage and event activity, with status labels (Excellent / Good / Needs Attention / Critical) * **Active Guardrails Strip**: Horizontal pill badges showing which guardrails are enabled/disabled at a glance, linking to the guardrails configuration page * **Recent Threats Table**: Main dashboard overview shows the last 5 blocked/flagged events across all projects with threat type badges, OWASP IDs, and click-through navigation * **Enhanced Global Search (⌘K)**: Server-side event search with debounced API calls, threat type and OWASP ID search, and result counts per group * **Sidebar Count Badges**: Interactions nav item shows a live count of flagged events in the last 24 hours * **StatsGrid Sparklines**: Inline SVG sparklines on stat cards showing trends from timeseries data * **Standardized Page Headers**: Consistent `PageHeader` component across Interactions, Analytics, and Security Rules pages with contextual action buttons and keyboard shortcut hints * **Keyboard Navigation**: `G` then `I/R/A/O/K/T/P` shortcuts for rapid project page navigation ### Custom Policy Engine * **7 policy types**: `input_filter`, `output_filter`, `topic_filter`, `llm_guard`, `entity_blocklist`, `rate_limit`, and `custom` - all manageable via API and dashboard * **Topic Filter**: Define conversation scope in natural language; an LLM judge blocks off-topic queries * **LLM Guard**: Custom natural-language business rules evaluated by an LLM judge for constraints too nuanced for regex * **Entity Blocklist**: Protect specific names, terms, or identifiers from appearing in prompts or responses with pipe-delimited matching * **`contains_text_any` condition**: Match any of multiple pipe-separated terms in a single rule (e.g., `"Acme|Globex|Initech"`) * Full dashboard UI for creating and managing all policy types, including `system_prompt_details` editor for topic filter and LLM guard ### Zero-Trust Response Verification * **HMAC-SHA256 response signing** (`X-PromptGuard-Signature`): Cryptographic proof that the response came from PromptGuard and was not tampered with * **Content hashing** (`X-PromptGuard-Content-Hash`): SHA-256 hash of the response body for independent integrity verification * **Zero-retention header** (`X-PromptGuard-Zero-Retention`): Explicit confirmation that prompt content was not stored when zero-retention mode is enabled * **Replay protection**: Timestamp-based signature validation with configurable max age (default 5 minutes) ### Per-Project Token Limits * Set `max_tokens_per_request` per project to cap prompt size before it reaches the LLM provider * Requests exceeding the limit are rejected with HTTP 413, saving LLM costs * **tiktoken integration**: Accurate token counting using OpenAI's tokenizer (falls back to `chars/4` heuristic) ### Hallucination Detection with RAG Context * **RAG context threading**: Automatically extracts grounding context from system messages and tool results in conversation history * **Source-grounded verification**: Compares LLM responses against retrieved documents for higher-accuracy hallucination scoring * **Configurable enforcement**: `metadata` (default), `flag` (log for review), or `block` (reject above threshold) * **Adjustable `block_threshold`** (0.0–1.0) for tuning sensitivity per project ### Hardened Container Security * **3-stage Dockerfile**: Build → Compile → Hardened production image * Source code compiled to `.pyc` bytecode; original `.py` files stripped from production image * Shell binaries removed (`/bin/sh`, `/bin/bash`, `curl`, `wget`, `apt-get`) - `kubectl exec` has nothing to invoke * Docker Compose: `read_only: true`, `cap_drop: ALL`, `no-new-privileges` * Helm chart: `readOnlyRootFilesystem`, `allowPrivilegeEscalation: false`, `capabilities.drop: ALL` ### Autonomous Red Team Agent * **LLM-powered adversarial search** discovers novel attack vectors through intelligent mutation * Budget-controlled iterations (1--1000) for configurable thoroughness * Generates graded security reports (A through F) with actionable recommendations * CLI support: `promptguard redteam --autonomous --budget 200` * SDK support: `pg.redteam.run_autonomous()` (Python) / `pg.redteam.runAutonomous()` (Node.js) ### Attack Intelligence Database * Anonymized bypass pattern storage for organizational learning * Query statistics via `GET /internal/redteam/intelligence/stats` * Categories, severity breakdown, and recent discovery counts ### CI/CD Security Gate * **GitHub Action** (`promptguard/security-gate@v1`) runs red team tests on every PR * Configurable minimum grade (A--F), regression detection, and PR comment reporting * Outputs: grade, score, bypasses found, and full JSON report ### MCP Server Security * Validate Model Context Protocol (MCP) tool calls before execution * Server allow/block-listing, JSON Schema argument validation, and resource access policies * Tool injection detection for MCP-based agent architectures ### Policy-as-Code (YAML) * Define guardrail configurations in YAML, version in git, apply via CLI * `promptguard policy apply` / `diff` / `export` commands * Validation, diffing, and idempotent application against live config ### Multimodal Guardrails * Image content safety via API delegation (Google Cloud Vision, Azure Content Safety) * OCR-based text extraction with PII detection on image content * Pluggable provider architecture for vision analysis ### Security Groundedness Detection * Detects security-relevant fabrication in LLM responses * Identifies hallucinated CVEs, fake compliance claims, and invented security statistics * Pattern-based confidence scoring with configurable thresholds ### Open Source AI Attack Dataset * Curated adversarial evaluation dataset with deterministic and LLM-powered mutations * 8 mutation categories: synonym substitution, character obfuscation, encoding, payload splitting, and more * HuggingFace-ready export for community benchmarking ### Performance & Observability * **PolicyEngine fast path** with thread-safe LRU cache (TTL-based) for sub-50ms repeated evaluations * **Per-detector profiling** with timing instrumentation for performance analysis * **OpenTelemetry metrics**: counters for block/allow decisions, latency histograms, detector-level timing * Plugs into Datadog, Grafana, Honeycomb, and any OTEL-compatible backend ### SDK & CLI Updates * Python + Node.js SDKs: `run_autonomous()` and `intelligence_stats()` methods on RedTeam class * CLI: `redteam --autonomous` flag with `--budget` control * CLI: `policy apply/diff/export` subcommands for YAML-based config management *** ## Late February 2026 ### Expanded Security Guardrails * Expanded from 7 to **10 security guardrails** (since grown to 14 with v3.3.0): Prompt Injection, PII Detection, Data Exfiltration, Toxicity, Secret Key Detection, URL Filtering, Fraud Detection, Malware Detection, Jailbreak Detection (LLM), and Tool Injection * **Jailbreak Detection (LLM)**: LLM-powered jailbreak detection catches sophisticated bypass attempts that evade traditional pattern matching, including multi-turn and encoded attacks * **URL Filtering**: Detect and block malicious, phishing, or unauthorized URLs in prompts and responses * **Tool Injection Detection**: Block attempts to inject malicious tool calls or manipulate agent tool usage through crafted prompts ### Enhanced PII Detection * Expanded PII coverage from 14 to **39+ entity types** across **10+ countries** * **Checksum validation** for structured identifiers (credit cards, IBANs, tax IDs, national IDs) * Country-specific entity support including national health numbers, driving licenses, and passport formats ### Secret Key Detection with Entropy Analysis * **Entropy-based analysis** to detect high-randomness strings that are likely secrets * Provider-specific pattern matching for major API key formats (AWS, Stripe, GitHub, etc.) ### Granular Guardrail Configuration Dashboard * Per-guardrail enable/disable and threshold configuration from the dashboard * Fine-tune sensitivity, actions (block/redact/log), and scope for each guardrail ### Streaming Output Guardrails * Real-time guardrail enforcement on **streaming responses** from LLM providers * Scan and filter output tokens as they stream, blocking threats mid-response without breaking the stream ### SDK Improvements * **Retry logic** with configurable backoff for transient failures in Python and Node.js SDKs * **Async Python client** for high-throughput, non-blocking guardrail calls * **Embeddings API** support - guardrail protection for embedding model requests ### Evaluation Framework * Benchmarking framework for measuring guardrail accuracy, latency, and false-positive rates * Pre-built test suites for prompt injection, PII detection, and jailbreak scenarios * Compare guardrail configurations side-by-side with detailed metrics *** ## February 2026 ### GitHub Code Security Scanner * **GitHub App integration** for connecting repositories to PromptGuard * Automatic scanning of repositories for unprotected LLM SDK calls * **AST-based detection** for both Python (`ast` module) and JS/TS (`tree-sitter`) -- zero false positives from comments, strings, or template literals * Auto-fix pull requests that add PromptGuard protection to detected LLM calls * CI checks on pull requests to flag new unprotected LLM usage * **Consolidated UX**: scan history, findings, and repository management all accessible from **Settings > Integrations** in a single expandable interface ### Organizations & Teams * Create team organizations with shared projects and billing * **Role-based access control**: Owner, Admin, Member, and Viewer roles * Invite members via email with configurable roles * Transfer ownership and manage invitations from **Settings > Team** * Full API support under `/dashboard/organizations` ### Enterprise Tier * **Self-hosted deployment** -- run PromptGuard on your own infrastructure * **Zero-trust / air-gapped mode** -- fully offline operation with no external API calls * **SSO** (SAML / OIDC) support * **Audit logs** and **IP allowlisting** * Custom data retention and dedicated support with SLA * Enterprise comparison table on pricing page ### SDK Auto-Instrumentation * **Python SDK**: `promptguard.init()` auto-patches OpenAI, Anthropic, Google, Cohere, and AWS Bedrock SDKs * **Node.js SDK**: `init()` auto-patches OpenAI, Anthropic, Google AI, Cohere, and AWS Bedrock SDKs * Works transparently with all frameworks (LangChain, CrewAI, LlamaIndex, Vercel AI SDK, AutoGen) * Enforce mode (block threats) and monitor mode (log only) * Fail-open by default with configurable fail-closed mode * Optional response scanning (`scan_responses` / `scanResponses`) ### Guard API * New `POST /api/v1/guard` endpoint for standalone content scanning * Accepts messages array with direction (input/output), model, and context * Returns decision (allow/block/redact), confidence score, threat details, and optional redacted messages * Used internally by auto-instrumentation and available directly via `GuardClient` ### Security Scan & Redact Endpoints * `POST /api/v1/security/scan` -- analyze raw text for prompt injection and other threats * `POST /api/v1/security/redact` -- strip PII from text with selective type filtering * Lightweight alternatives to the Guard API for pipelines and batch processing ### Framework Integrations * **LangChain.js** callback handler (`PromptGuardCallbackHandler`) * **Vercel AI SDK** middleware (`promptGuardMiddleware`) * Python: Native support via auto-instrumentation for LangChain, CrewAI, LlamaIndex ### Documentation Overhaul * Rewrote Python and Node.js SDK references to cover auto-instrumentation, GuardClient, and framework integrations * Added Enterprise pricing tier with feature comparison * Added Guard API, Security Scan, and Security Redact API reference pages * Added Organizations & Teams documentation * Regenerated OpenAPI spec (35 developer endpoints, 20 schemas) * Updated pricing to match current plans (\$149/month Scale, Enterprise tier) ### Code Quality * Tree-sitter AST parsing for JS/TS code scanning (replacing regex) * Shared detection manifest (`sdk-patterns.json`) as single source of truth for LLM SDK patterns * Removed 17 unused backend endpoint files and dead code *** ## January 2026 ### Billing & Subscriptions * Plan change with proration support (upgrade/downgrade mid-cycle) * Usage-based billing alerts at 80% and 100% thresholds * Stripe integration with metered billing for Scale plan overage ### Security Improvements * AI-powered threat detection with F1 = 0.887 and 99.1% precision * Enhanced PII detection patterns (SSN, credit card, API keys) * Red team test suite with 25+ adversarial test cases *** ## December 2025 ### Initial Launch * PromptGuard API (OpenAI-compatible proxy) * Dashboard with project management and analytics * Free, Pro, and Scale subscription tiers * Regex-based threat detection * PII redaction (email, phone, SSN, credit card) * Rate limiting and usage tracking *** For feature requests or bug reports, contact [support@promptguard.co](mailto:support@promptguard.co).