NeMo Guardrails vs Guardrails AI vs Llama Guard: Which to Deploy?

Last updated October 20, 2026. Releases, licenses, model cards, package registries, and download counts were checked on that date, and both Python frameworks were installed and run on an AgentStack test machine the same day.

Deploy NVIDIA NeMo Guardrails when you need one framework that orchestrates input, output, and tool call rails, Guardrails AI when your main job is validating structured outputs, and Llama Guard 4 when you want a free content safety classifier you host yourself. In NeMo Guardrails vs Guardrails AI vs Llama Guard, the three are less rivals than layers, and NeMo Guardrails can call the other two as rails.

The comparison changed in 2026. Guardrails AI shut its validator hub and hosted inference on August 25 and was acquired by Harvey on September 9, while Meta has not updated Llama Guard since April 2025. NeMo Guardrails shipped six releases this year, including local tool call validation in July.

NeMo Guardrails vs Guardrails AI vs Llama Guard is the open-source shortlist for teams whose prompts cannot leave their network. This comparison sits in our agent security coverage within AI governance and security. No project paid for placement or reviewed this page, per our editorial standards and disclosure policy.

How We Compared NeMo Guardrails, Guardrails AI, and Llama Guard

We compared the three on what an agent team has to run in production: which risks each one catches, whether it can check tool calls, what it costs in hardware, and whether it is still maintained. Every claim comes from a release note, model card, package registry, or our own test on October 20, 2026.

• Coverage: prompt injection and jailbreaks, the top risk in the OWASP Top 10 for LLM applications, plus harmful output, PII, and structured output errors.
• Agent fit: whether the tool documents a check on a proposed tool call or a tool result before the agent acts on it.
• Hands-on footprint: clean installs of nemoguardrails 0.24.1 and guardrails-ai 0.11.0 on Python 3.13, then 200 checks of the same 20 prompts through each.
• Maintenance: commits on the main branch since July 22, 2026, read from git history, plus release dates and 30-day downloads from PyPI and Hugging Face.
• Hardware and license: GPU needs, model size, and the terms that come with each license.

We did not run Llama Guard 4 ourselves, because its weights are gated behind Meta’s manual approval on Hugging Face. Its accuracy figures below are Meta’s own, measured on Meta’s in-house test set, so treat them as a vendor claim to verify against your traffic.

NeMo Guardrails vs Guardrails AI vs Llama Guard at a Glance

Choose NeMo Guardrails to orchestrate rails around an agent, Guardrails AI to validate and repair structured outputs, and Llama Guard 4 as the classifier model behind a content safety rail. Choose none of them as your only control when an agent holds write access it never needs. The table compares all three on facts checked on October 20, 2026.

Attribute	NVIDIA NeMo Guardrails	Guardrails AI	Meta Llama Guard 4
What it is	Python framework that runs input, output, retrieval, and tool rails	Python library that runs validators on inputs and outputs	12B safety classifier model, plus Prompt Guard 2 for injection
Best for	Agent teams that want one policy layer for many checks	Schema checks, corrective reasks, and output repair	Free content safety labels across 14 hazard categories
License	Apache 2.0	Apache 2.0	Llama 4 Community License
Latest release	v0.24.1, September 16, 2026	v0.11.0, August 14, 2026	April 29, 2025
Tool call checks	Yes, local rails for tool calls and tool results since v0.23.0	Not documented	Code Interpreter Abuse category only
Needs a GPU	No for rule rails; yes if you self-host model rails	No for rule validators; yes for some local models	Yes, sized for a single GPU
2026 ownership news	None; NVIDIA maintained	Acquired by Harvey, September 9, 2026	None; no new model since April 2025

Verdict: NeMo Guardrails wins for agent teams because it is the only one of the three that validates tool calls and can host the other two as rails. Guardrails AI wins for strict output formats on any model. Llama Guard 4 wins when you need a free, self-hosted safety classifier and can give it a GPU.

What Our October 20 Hands-On Test Found

Both frameworks blocked 10 of 10 prompts carrying leaked secrets and flagged 0 of 10 clean prompts, at a median of 5.1 milliseconds per check for NeMo Guardrails and 2.6 milliseconds for Guardrails AI. We installed each into a clean Python 3.13 environment on an 8 vCPU Intel Xeon machine on October 20, 2026.

• NeMo Guardrails installed lighter. It took 11.0 seconds, 64 packages, and 284 MB, against 20.8 seconds, 112 packages, and 449 MB for Guardrails AI, which pulls in LiteLLM, the OpenAI SDK, and OpenTelemetry exporters.
• Guardrails AI checked faster per call. Its secrets validator ran at a 2.6 ms median and 3.2 ms 95th percentile, and NeMo Guardrails’ regex rail ran at 5.1 ms and 6.0 ms. Repeat runs stayed within 0.3 ms.
• Both caught every planted secret. The set covered AWS keys, a GitHub token, a Stripe live key, a private key header, a password, and a Slack token, with 10 everyday agent requests as controls.
• Cold start favored NeMo Guardrails. It imported in 0.5 seconds against 1.5 seconds, which matters for serverless functions that start often.

Framework overhead is a rounding error next to a model call, so pick the framework on coverage and maintenance, then budget for the classifier models behind it. A Llama Guard 4 rail adds a 12 billion parameter model call to every check, which is where latency and GPU cost actually come from.

The two detectors were different by design: NeMo Guardrails used its built-in regex input rail through LLMRails.check(), and Guardrails AI used the guardrails-ai-secrets-present validator built on detect-secrets. Read the result as a framework footprint test on one machine, since a 20 prompt set says nothing about detection rates on real traffic.

# NeMo Guardrails 0.24.1: regex input rail, no LLM call
from nemoguardrails import RailsConfig, LLMRails
YAML = """
rails:
  config:
    regex_detection:
      input:
        patterns: ["AKIA[0-9A-Z]{16}", "ghp_[A-Za-z0-9]{36}", "sk_live_[A-Za-z0-9]{20,}"]
  input:
    flows: [regex check input]
"""
rails = LLMRails(RailsConfig.from_content(yaml_content=YAML))
print(rails.check([{"role": "user", "content": prompt}]).status)  # PASSED or BLOCKED

# Guardrails AI 0.11.0: pip install guardrails-ai-secrets-present
from guardrails import Guard, OnFailAction
from guardrails_ai.secrets_present import SecretsPresent
guard = Guard().use(SecretsPresent(on_fail=OnFailAction.EXCEPTION))
guard.validate(prompt)  # raises when a secret is found

Who Is Still Shipping: Maintenance in 2026

NeMo Guardrails is the only one of the three under steady development in October 2026, with 111 commits on its main branch since July 22. Guardrails AI logged 23 commits in that window and none after August 26. Meta’s PurpleLlama repository logged 11, and none touched Llama Guard.

• NeMo Guardrails: 111 commits from seven people plus automation bots, releases v0.23.0, v0.24.0, and v0.24.1 since July, and 525,573 downloads in the last 30 days on pypistats.org.
• Guardrails AI: 23 commits from two people, mostly the hub retirement and security patches, v0.11.0 on August 14, and 101,253 PyPI downloads in the last 30 days.
• Llama Guard: Llama Guard 4 had 47,226 Hugging Face downloads in the last 30 days, and the original Prompt Guard 86M had 2,456,720, which suggests many teams still run the 2024 injection model.

Download counts are a rough signal, since CI pipelines and mirrors inflate them. Harvey’s own announcement cites more than 250,000 monthly downloads for the Guardrails framework, a higher figure than pypistats.org reports for the guardrails-ai package.

NeMo Guardrails, Guardrails AI, and Llama Guard Up Close

Each profile below covers what the project is, what changed in 2026, and where it fits in an agent stack. The homepage screenshot sits directly under each heading, followed by the release or documentation page that matters most for a deployment decision today, captured the same afternoon.

NVIDIA NeMo Guardrails: the orchestration layer with tool call rails

NVIDIA NeMo Guardrails is an open-source Python library that wraps an LLM application in programmable rails for inputs, outputs, retrieval, dialog, and tool calls. Rails are written in YAML and Colang, NVIDIA’s flow language, and the installed 0.24.1 package ships 31 integration folders, including Llama Guard and Guardrails AI.

Version 0.23.0 on July 1, 2026 added streaming and non-streaming tool calling to IORails, its newer engine, with local rails that validate model-emitted tool calls and tool results. Version 0.24.0 on August 26 lets IORails run 59 of the library’s 67 action-backed rail surfaces, per the v0.24.0 release notes.

• Best for: Agent teams that want one policy layer for prompts, outputs, retrieved chunks, and tool calls, self-hosted.
• Cost (October 2026): Free under Apache 2.0. Model-backed rails cost tokens or GPU time, for example NVIDIA’s NemoGuard NIMs or a self-hosted Llama Guard.
• Watch out for: Breaking changes in most minor releases, such as the RailOutcome action contract in 0.24.0, and anonymous usage reporting since 0.22.0 that you opt out of with NEMO_GUARDRAILS_NO_USAGE_STATS=1.

Red Hat ships NeMo Guardrails inside its MCP gateway, as our Red Hat MCP Gateway GA report covers, which shows how often the framework ends up embedded in other products.

Guardrails AI: output validation after the hub shutdown

Guardrails AI is an open-source Python library that runs validators on LLM inputs and outputs, then raises, filters, fixes, or reasks the model when a check fails. It is strongest at structured output: Pydantic schemas, JSON validity, value ranges, and PII, on any model reachable through LiteLLM.

The project’s hub retirement notice set a hard cutoff of August 25, 2026 for guardrails hub install, the private validator registry, and Guardrails’ free hosted inference servers. Validators now install from public PyPI, as in pip install guardrails-ai-detect-pii, and model-backed ones need use_local=True or your own endpoint.

On October 20, 2026, PyPI listed 68 packages named guardrails-ai- plus a validator name, beyond the core SDK and types packages. The guardrails-ai-llamaguard-7b validator, version 0.1.0, raises NotImplementedError for local inference, so it works only against an endpoint you host now that Guardrails’ servers are gone.

• Best for: Teams that need strict output formats, corrective reasks, and PII or schema validators on any model.
• Cost (October 2026): Free under Apache 2.0. Validators that load models locally need CPU or GPU capacity; hosted inference is no longer offered.
• Watch out for: Harvey acquired the company on September 9, 2026 and its co-founders joined Harvey’s product team, per Harvey; plan for slower open-source maintenance.

Meta Llama Guard 4 and Prompt Guard 2: the classifier models

Llama Guard 4 is a 12 billion parameter open-weight model that labels a prompt or a response as safe or unsafe and names the violated hazard categories. Meta pruned it from Llama 4 Scout and trained it on the MLCommons hazard taxonomy plus an added S14 Code Interpreter Abuse category for text-only tool calls, 14 categories in all, per its model card.

Meta reports 69% recall, an 11% false positive rate, and a 61% F1 score on English output filtering, and 43% recall on multilingual text, measured on its in-house test set. Prompt Guard 2 is the separate injection and jailbreak classifier, in 86M and 22M sizes, and both were last modified on Hugging Face in April 2025.

• Best for: Teams that need a free content safety classifier on their own GPU, wired in through NeMo Guardrails or their own code.
• Cost (October 2026): Free weights under the Llama 4 Community License; you pay for a GPU that holds 24 GB of BF16 weights.
• Watch out for: Manual access approval on Hugging Face, a license clause requiring a separate Meta license above 700 million monthly active users, and no model update since April 2025.

Meta’s agent-focused wrapper, LlamaFirewall, combines Prompt Guard 2, an AlignmentCheck auditor, CodeShield, and regex scanners. Its latest PyPI release is 1.0.3 from May 29, 2025, with 4,553 downloads in the last 30 days.

How NeMo Guardrails Runs Llama Guard and Guardrails AI Together

The most practical deployment uses NeMo Guardrails as the orchestrator, Llama Guard 4 as a self-hosted content safety rail, and a Guardrails AI validator where output structure matters. NeMo Guardrails ships folders for both integrations, so one configuration file can call all three on each agent step.

1. Serve Llama Guard 4 behind an OpenAI-compatible endpoint such as vLLM on one GPU, and keep the weights inside your network.
2. Add a model of type llama_guard to the NeMo Guardrails config and turn on the llama guard check input and llama guard check output flows.
3. Replace the documented example prompts, which still target the 2023 LlamaGuard-7b categories, with Llama Guard 4’s S1 to S14 policy text.
4. Turn on tool call and tool result rails in IORails for agents, so a proposed call is checked before it runs.
5. Add Guardrails AI validators through NeMo Guardrails’ integration, or call them directly, for schema and PII checks on final outputs.
6. Send rail decisions to your traces, using the tools in our AI agent observability guide, so blocks and false positives are visible.

Test the stack before launch with the AI agent testing tools we ranked, and measure block rates against a labeled set with the AI agent evaluation tools we compared.

Agent and Tool Call Coverage Compared

NeMo Guardrails documents the widest agent coverage of the three, because it validates tool calls and tool results as well as prompts, outputs, and retrieved chunks. Guardrails AI focuses on validating text and structured data, and Llama Guard 4 classifies text and images against a fixed hazard list.

Control	NeMo Guardrails	Guardrails AI	Llama Guard 4 and Prompt Guard 2
Prompt injection and jailbreak	Built-in jailbreak rails and third-party detectors	Detect jailbreak and prompt injection validators on PyPI	Prompt Guard 2 classifier
Harmful output	Content safety rails backed by a model you choose	Toxic language and NSFW validators	14 hazard categories, text and images
Tool call validation	Yes, local tool call rails since v0.23.0	Not documented	S14 Code Interpreter Abuse only
Tool result screening	Yes, tool result rails since v0.23.0	Not documented	Classify the text yourself
Structured output repair	Not a focus	Yes, schema validation with reask and fix	No
PII	GLiNER, Presidio, and Private AI rails	Detect PII validator, local model	S7 Privacy category
Custom policy	YAML and Colang flows, custom actions	Custom validators in Python	Edit category text in the prompt

Verdict: Choose NeMo Guardrails when tool calls are the risk you most need to control. Choose Guardrails AI when a malformed or noncompliant output is the bigger risk. Llama Guard 4 belongs behind one of the two frameworks as a classifier, since it makes no decision about what your agent should do next.

What Each Option Costs to Run in 2026

All three are free to license, so the real cost is the hardware for model-backed checks: CPU is enough for rule rails, while Llama Guard 4 needs a GPU that holds 24 GB of weights. Guardrails AI’s free hosted inference ended on August 25, 2026, which moved that cost onto your own infrastructure.

Component	License cost	Hardware	Hidden cost
NeMo Guardrails framework	Free, Apache 2.0	CPU; 284 MB environment in our test	Upgrades across frequent breaking changes
Guardrails AI framework	Free, Apache 2.0	CPU; 449 MB environment in our test	Migrating hub imports to PyPI packages
Llama Guard 4 12B	Free, Llama 4 Community License	One GPU for 24 GB of BF16 weights	Serving, scaling, and prompt updates
Prompt Guard 2 22M or 86M	Free, Llama 4 Community License	CPU or small GPU	Threshold tuning for false positives
Model-backed rails through an API	Per token or per request	None on your side	Prompts leave your network

Verdict: A CPU-only stack of NeMo Guardrails or Guardrails AI with rule rails and Prompt Guard 2 costs little beyond engineering time. Add Llama Guard 4 only when you need its hazard taxonomy and can keep a GPU busy enough to justify it. Smaller teams can start with Llama Guard 3 1B, which has 1.5 billion parameters.

Which Should You Deploy?

The right pick depends on what your agents do, where data may go, and how much engineering time you have for upkeep. Find the profile below that matches your team, then shortlist the named option and test it on your own prompts, outputs, and tool calls before you trust a block rate.

Teams shipping agents that call tools

• Deploy NeMo Guardrails with IORails tool call and tool result rails.
• Add Prompt Guard 2 or a NemoGuard jailbreak model for injection screening.
• Compare agent frameworks in our AI agent frameworks guide before you wire rails into one SDK.

Teams that need strict output formats

• Deploy Guardrails AI for schema validation, reasks, and PII checks.
• Pin validator versions from PyPI and move any hosted validators to use_local=True.
• Pair it with a tool call check elsewhere, since Guardrails AI does not document one.

Teams that must keep everything on premises

• Serve Llama Guard 4 on your own GPU and call it through NeMo Guardrails.
• Use Prompt Guard 2 22M on CPU when GPU capacity is short.
• Route model traffic through one of the LLM gateways we compared so every call is logged.

Teams with no ML infrastructure

• Start with NeMo Guardrails rule rails and a hosted content safety API.
• Skip self-hosted Llama Guard 4 until traffic justifies a GPU.
• Track blocks and misses with the open-source LLM observability tools we ranked.

When None of the Three Is the Right Tool

None of the three is the right first fix when an agent can reach data or actions it never needs. A classifier with 69% recall on Meta’s own test set still misses about three in ten unsafe outputs, so a support agent with write access to billing needs scoped credentials before it needs another filter.

Start with least-privilege tool access, an MCP gateway that centralizes tool permissions, and human approval for irreversible actions. Teams that want a managed detector with a service agreement are better served by a cloud guardrail API, and the NIST and CISA incident practices for rogue agents cover what to do when any guardrail misses.

Frequently Asked Questions

Related Guides

Teams replacing a managed guard API often look at these open-source options. Our 7 best Lakera alternatives covers the managed side of that choice.

For related coverage, see our AI guardrails tools and AI agent security tools.

Read the AI governance and security hub, agent security coverage, governance and compliance coverage, AI agent frameworks, MCP explained, MCP gateways, LLM gateways, AgentOps tools, AI agent observability tools, AI agent evaluation tools, AI agent testing tools, Red Hat MCP Gateway with NeMo Guardrails, ToFu MCP tool security bugs, FastMCP client RCE advisory, Microsoft Dynamic Agent Risk and Guardian Agents, and Anthropic pulling evals offline after agents overstepped. Notes on how we work sit on editorial standards, disclosure, and contact.

The Bottom Line

Deploy NeMo Guardrails as the rail layer for agents, add Llama Guard 4 behind it when you can host a GPU, and keep Guardrails AI for structured output validation. That stack covers prompts, outputs, and tool calls while keeping every check inside your network.

Recheck Guardrails AI’s commit history and Meta’s model page before you renew either commitment, since both projects were quiet through October 2026. Send corrections or test results through our contact page.