What it is
Guardrails is a Python library that wraps model calls in Guards: chains of validators that check inputs and outputs for problems such as PII, toxic language, competitor mentions or malformed structure, and then block, fix or re-ask. It also helps get structured data out of an LLM.
The project is winding down. Harvey, the legal AI company, acquired Guardrails AI on 9 September 2026 and the founders joined Harvey's product team. A fortnight earlier, on 25 August 2026, the Guardrails Hub installer, the private validator registry and the free hosted inference servers were shut down; validators are now separate guardrails-ai-<name> packages on PyPI, and those that need a model must run it locally or on your own endpoint. The last commit to the main branch was on 26 August 2026 and the last release, 0.11.0, on 14 August 2026.
In May 2026 an attacker published a malicious guardrails-ai 0.10.1 to PyPI; it was quarantined within about two hours, and anyone who installed it is told to treat the machine as compromised.
Our review
Guardrails AI is hard to recommend for a new project. The library still works and is Apache 2.0, but the parts that made it convenient have gone. The Hub installer and free hosted inference closed on 25 August 2026, Harvey bought the company a fortnight later, and Harvey's announcement says nothing about the library's future. Since 26 August nothing has been merged to main; community fixes for re-ask crashes and zero re-ask budgets, and security bot pull requests for pyjwt and urllib3, sit open or were closed unmerged.
The idea remains sound. Validators are small, testable checks stacked around a model call, Harvey says the framework is downloaded more than 250,000 times a month, and for deterministic checks such as regex patterns, JSON schema or length limits it still does the job without any network dependency.
The supply chain needs attention. A malicious 0.10.1 reached PyPI on 11 May 2026 and was quarantined about two hours later; the maintainers advised rotating every credential on any machine that installed it. Validators now arrive as dozens of separate PyPI packages, each a dependency to pin and audit, and the package also turns on anonymous usage metrics by default, sent over OpenTelemetry to an AWS endpoint, until you run guardrails configure --disable-metrics.
Model-based validators are where the shutdown bites. PII, toxicity and competitor checks that ran on Guardrails' servers now need use_local=True or your own inference endpoint, and at that point calling a dedicated classifier such as Llama Prompt Guard 2 directly, or moving to the actively developed NeMo Guardrails, is less code to own.
Where it earns its place
A backend engineer with Guardrails already wrapping a claims-extraction service
Keep regex and JSON-schema checks running after the Hub shutdown
Pin guardrails-ai==0.11.0, swap guardrails hub install for pip install guardrails-ai-<name>, change imports to the guardrails_ai namespace and disable metrics. Deterministic validators then run with no network calls; the risk is that future fixes are yours to make.
An ML engineer at a 50-person fintech that relied on hosted PII detection
Replace the PII validator that stopped working on 25 August
Set use_local=True so the model downloads and runs on your own hardware, or point validation_endpoint at a self-hosted service. Either way you now pay for the compute that Guardrails used to give away.
A security lead auditing an AI product's dependency tree
Decide whether Guardrails can stay in production
Check no build ever pulled 0.10.1, rotate credentials if one did, and weigh an unmaintained dependency with dozens of validator packages against moving checks to NeMo Guardrails or direct classifier calls.
Before you commit
- Setup
- pip install guardrails-ai on Python 3.10 to 3.13 (3.14 is not supported), then pip install each validator as guardrails-ai-<name>. A Flask-based guardrails start server is available for running Guards as a service.
- Integrations
- Wraps OpenAI and LiteLLM-supported model calls, Pydantic models for structured output, and an OpenAI-compatible server mode; traces can be exported over OpenTelemetry.
- Data and privacy
- Anonymous usage metrics are enabled by default and sent to an AWS-hosted OTLP endpoint; guardrails configure --disable-metrics turns them off. Model-based validators send nothing once run locally. One critical advisory: the malicious 0.10.1 PyPI release of 11 May 2026.
- Cost at scale
- The library is free and there is no paid edition any more. Model-based validators now need your own CPU or GPU, or an inference endpoint you host.
- Limits
- No merges to main since 26 August 2026; 65 open issues and pull requests, including a re-ask crash on whole-output validators. When the Hub change was announced, 50 of 64 validators had been moved to PyPI.
What's good
- Simple Guard and validator model
- Apache 2.0 licence
- Deterministic validators run fully offline
What's not
- Hub and hosted inference shut down on 25 August 2026
- Nothing merged to main since 26 August 2026
- Malicious 0.10.1 published to PyPI in May 2026
- Anonymous usage metrics on by default
Best for
Existing users with deterministic validators who can pin versions and patch it themselves.
Alternatives
Guardrails AI: common questions
- Is Guardrails AI worth it?
- A sound idea left without an owner: the Apache 2.0 code still runs, but nobody is merging fixes and the hosted pieces are gone. We rate it 3.2 out of 5.
- How much does Guardrails AI cost?
- Free and open source under Apache 2.0. The hosted Hub registry and free remote inference closed on 25 August 2026.
- What are the downsides of Guardrails AI?
- Hub and hosted inference shut down on 25 August 2026; nothing merged to main since 26 August 2026; malicious 0.10.1 published to PyPI in May 2026; anonymous usage metrics on by default.
- Who is Guardrails AI best for?
- Existing users with deterministic validators who can pin versions and patch it themselves.
- How much does Guardrails AI cost for a team or in production?
- The library is free and there is no paid edition any more. Model-based validators now need your own CPU or GPU, or an inference endpoint you host.
- Is Guardrails AI safe for company data?
- Anonymous usage metrics are enabled by default and sent to an AWS-hosted OTLP endpoint; guardrails configure --disable-metrics turns them off. Model-based validators send nothing once run locally. One critical advisory: the malicious 0.10.1 PyPI release of 11 May 2026.
- What are the best Guardrails AI alternatives?
- The closest alternatives we have reviewed are NVIDIA NeMo Guardrails and promptfoo.
Answers checked Oct 23, 2026.