OpenGuardrails

license

Apache-2.0(OSI) for both platform and model

source

public

self-host

yes(on-prem/private)

model

OpenGuardrails-Text-2510 open weights Apache-2.0

core features withheld

no

The OGR protocol, its reference runtimes and SDKs, and the OpenGuardrails-Text safety model are published under Apache-2.0 and run without the vendor's service. The vendor's own detection runtime and console are a separate commercial product, sold as SaaS or as a licensed private deployment.

• https://github.com/openguardrails/openguardrails recorded 2026-08-13

  Repo metadata records license spdxId - Apache-2.0 and the README closes 'License. Apache-2.0'. The monorepo holds specification/ and schema/, packages/python and packages/javascript, integrations/, benchmarks/ and examples/, and the development section builds and tests the whole thing locally. The project describes itself as foundation-governed and neutral; there is no paid tier, enterprise directory or license key on the page.

• https://huggingface.co/openguardrails/OpenGuardrails-Text-2510 recorded 2026-08-13

  Model repo is ungated and carries License - apache-2.0 with a LICENSE file and two safetensors shards; cardData records base_model - Qwen/Qwen3-14B and quantization - GPTQ-4bit, which is the 3.3B quantized safety model the score records.

OpenGuardrails is early-stage, so GitHub stars are the only available adoption signal, and a star is not a use. It does publish SDKs to PyPI and npm, so a download figure may become available later.

• https://github.com/openguardrails/openguardrails recorded 2026-08-13

  stargazerCount 24 for openguardrails/openguardrails; no download, install or customer figure appears on the page.

OpenGuardrails pairs an open safety model, covering content safety and prompt attacks across 119 languages, with a guardrail platform that runs as a gateway or API service, as the paper describes. The platform is now sold as a commercial runtime, while the open repository carries the OGR protocol, reference runtimes and a detector benchmark.

• https://arxiv.org/abs/2510.19169 recorded 2026-09-29

  The arXiv abstract presents OpenGuardrails as the "first fully open-source platform that unifies large-model-based safety detection, manipulation defense, and deployable guardrail infrastructure", covering "content-safety violations such as harmful or explicit text generation", "model-manipulation attacks including prompt injection, jailbreaks, and code-interpreter abuse", and "data leakage involving sensitive or private information". It adds that "The system supports 119 languages" and "can be deployed as a secure gateway or API-based service for enterprise use".

• https://huggingface.co/openguardrails/OpenGuardrails-Text-2510/raw/main/README.md recorded 2026-09-29

  The model card describes "a 3.3B-parameter quantized large language model for" content safety detection and prompt attack prevention that "effectively performs both" content safety classification and prompt manipulation defense, "including prompt injections, jailbreaks, and code abuse attempts". It says the model "Supports" "119 languages and dialects" and was "fine-tuned from a 14B dense model and quantized via GPTQ to 3.3B parameters".

• https://openguardrails.com recorded 2026-09-29

  The vendor homepage now sells OpenGuardrails as a commercial runtime and names only the OGR protocol as open, saying "The runtime is commercial, but the contract it serves is not" and "The product is commercial; the contract never will be". On-premises use is the paid enterprise tier, "Private deployment, annual license. OpenGuardrails in your infrastructure", described as "It is the SaaS product, not a lesser edition" with a "Commercial license with support and an SLA, priced on fleet size." The hosted plans state "There is no free tier".