The AI gateway
that catches
before your agent acts.
If it helps, star it on GitHub
Calus intercepts every call your app makes to OpenAI, Anthropic, Groq, or any LiteLLM-supported provider. It scans each prompt and tool response for prompt injection, jailbreaks, and agent abuse before the model ever sees them. No code changes to your app. Your provider key travels with the request and is never stored.
It is detection-only. Calus never blocks or rewrites traffic. It flags what it finds, adds verdict headers to every response, and logs everything to a live dashboard. You decide what to do next.
Mapped to the OWASP LLM Top 10 (2025). Every pattern is readable in the repo.
Hidden instructions in tool outputs, documents, and web pages attempting to override your agent's goals or extract data.
Role-play, persona switching, DAN, AIM, and "ignore previous instructions" guardrail bypasses. 100% recall on all manual templates.
API keys, bearer tokens, SSNs, and credit card numbers. Calus detects them and can mask them before anything is stored.
Destructive shell commands, reverse shells, eval injection sinks, and deserialization gadgets embedded in content your agent processes.
Poisoned tool descriptions, rug-pulls, and tool output that issues new agent instructions. This is the part of the attack surface most tools do not cover.
XSS, SSRF to cloud metadata endpoints, and server-side template injection gadgets from pages, PDFs, or documents your agent browses.
Calus sits between your app and the model provider. It scans every prompt, tool output, and document your agent reads, then logs what it finds in a live dashboard and adds verdict headers to each response. No code changes. Your traffic is never modified.
Set OPENAI_BASE_URL to http://localhost:8000/v1 and run your app. That is all the setup required.
Scored by the real engine against held-out academic benchmarks. Every number is reproducible with one command.
Most inputs are settled in the first step in under 5 ms. Only the unclear ones move to the next step.
Curated regex engine plus base64, unicode, and spacing decoders catch known patterns instantly. 27,871 patterns, all readable.
Lexical similarity matching catches paraphrases and variants that the rule set doesn't spell out literally.
An optional embedding model for novel attacks that slip past the first two steps. No GPU required.
A confidence score, the matched OWASP category, and the reason it flagged. These show up in the response headers and the dashboard.
Calus works with OpenAI, Anthropic, Groq, LangChain, and anything LiteLLM supports. You set one environment variable.
Set base_url. Your key travels with the request, never logged or stored.
Pass baseURL and defaultHeaders to name agents in the dashboard.
Use default_headers with X-Calus-Agent to name the agent in the live dashboard.
Proxy and dashboard in a single docker compose up. No extra config needed.
Clone the repo, run docker compose up, and set one environment variable. Done.