Loading
What is in it
Six things, and one of them is ours alone.
Every card is a real screen. Open one for the long version.
All six, with the detectors, the grants and the chain in full
Evidence
Measured with every detector switched off.
Switching the detectors off is a total bypass rather than a weakened threshold or a simulated miss. What is left is capability grants, argument provenance and declared impact tiers, which is the whole design.
8 of 8attacks contained with every detector switched off
4 of 4legitimate calls still allowed in that same run
42 of 42AgentDojo attacker calls that act, contained
62 of 65attacker calls contained overall, three read-only escapes
66.7%held-out prompt-injection recall, our weakest layer
The three calls that escaped the AgentDojo replay are all read-only, and the benchmark page names them one by one. The weakest figure is in the set on purpose.
Getting there
From nothing to governed, in the order you would actually do it.
Nothing in the first three steps refuses a call. A library that starts rejecting production traffic because someone added an import gets switched off within a day.
One exception from day one: a tool that can move money, delete something or send an email, called with a value that came from a document rather than a person, is refused or sent to a human.
Point it at a repository or a live API
It proposes what it found: what in your code talks to a model, what is ungoverned, and which tools exist. You register each agent, give it an owner, and correct anything the scan got wrong.
Put one line in your entry point, or call it over HTTP
import nometria; nometria.auto()wraps the OpenAI, Anthropic, LiteLLM and LangChain clients already running in that process. From any other language, post a single tool call to/v1/guard/tool_call, or point an existing client’s base URL at the gateway and change nothing else.Watch in observe mode, where nothing is blocked
The policy that governs model traffic starts in observe: it records what it would have done and lets the call through. You read what gets flagged against your own traffic and tune the detectors per policy before anything is refused.
Turn enforcement on when the findings look right
nometria policy enforce baselineis the one step that starts blocking model traffic, and the one-liner picks it up with no code change.nometria policy observe baselineputs it back.
Editions
Free forever, supported, or waiting.
Same software in all three. What you pay for is a support relationship.
Open source
Available nowWhat you get
The whole control plane. Every feature above, none of them gated.
Who it is for
Anyone who wants to read the code that decides what their agent may do.
Cost
Free, Apache-2.0. No licence key, no gated features.
Supported self-hosted
Available nowWhat you get
The identical software, plus help with rollout and priority on fixes.
Who it is for
Teams putting this in front of an auditor who want a named person to call.
Cost
Talk to us. Not priced yet, and we would rather agree it with the first few teams than guess.
Start hereEmail support@nometria.com
Managed cloud (in development)
In developmentWhat you get
Nothing yet. It is in development and you cannot sign up today.
Who it is for
Teams who would rather not run it themselves, once it exists.
Cost
Nothing is priced, because nothing is running.
Start hereJoin the waitlist
Licence
Apache-2.0 in full. It stays that way.
LICENSEOffline
No API key, no downloaded weights.
nometria init && nometria demoNo telemetry
Nothing calls a Nometria server. Outbound hosts are the ones you configure.
src/nometria/config.pyReproducible
Every published figure has a script that regenerates it.
benchmarks/Why open
The core is open, and stays open.
You cannot audit a black box
This software decides what your agent is allowed to do. That decision is only worth trusting if you can read the code that makes it.
Auditors should not have to trust us
Every evidence package carries verify_chain.py, a stdlib-only script that re-derives the hash chain from the exported rows. It runs without us and without our API.
The unreviewed parts say so
Compliance mappings were produced from framework texts by engineers, not reviewed by counsel. They ship labelled DRAFT rather than being quietly left out.
What it does not do
The limits, in our own words, before you find them yourself.
We do not claim adversarial robustness and we do not believe anyone can claim it honestly today. Here is everything that follows from that.
Detection is a speed bump, and we measure it against ourselves
Held-out injection recall is 66.7%. An attacker who reads our verdict and tries again gets 73% of what we do catch through within 50 attempts.
On detection, a competitor beats us
On indirect injection through tool output, an installed llm-guard is more precise on the same 20 cases: 81.8% against our 66.7%. Which is why we lead with containment.
Containment is only as good as the declarations behind it
Grants and impact tiers are declared by whoever operates the agent, and every check believes them. A tool recorded as read-only that is not read-only is not covered.
It is MVP v0.3
No SSO. Multi-tenancy is enforced at the session for a single organisation, and this is not a managed multi-region offering. Text only: no images, audio or video.
Before you install anything
The questions developers actually ask.
What does it cost, and under what licence?
Apache-2.0, with the full text in LICENSE. It is free and there is nothing to buy: all of the source is in the repository, there is no licence key, and nothing is gated behind a paid tier.
Does my traffic or my source leave the machine?
No. A repository scan walks your source with a parser, never imports it, never runs it and makes no network call. A local install downloads no weights and needs no API key, and Nometria adds no destination of its own.
Where does this sit relative to a gateway or a web application firewall?
A firewall reads HTTP at the edge; a gateway routes and rate-limits it. Neither knows which agent made the call, what it was granted, or where an argument’s value came from. This works one layer in, on the agent’s own actions, and replaces neither.
What does it cost in latency?
We have not benchmarked it, so we will not quote you a number. What is written down: detectors run under a shipped 40ms timeout each, and the tool-call check reads no text and calls no model at all.
Try to break it before you trust it.
The playground needs no account and no install, and it runs the same enforcement code as the product. If you would rather run it yourself, the demo is two commands and finishes offline in about six seconds.
pip install git+https://github.com/architsharm/guardrails.git nometria init && nometria demo
init creates a SQLite database and loads 43 controls and three policy packs. demo runs a thirteen-step walkthrough. Both are offline: no API key, no downloaded weights, no network egress.