IronWarden – A microsecond PII firewall for streaming LLMs in safe Rust

IronWarden is a sovereign, ultra-low-latency AI security reverse proxy and PII firewall written in bare-metal Rust.

Point any OpenAI, Anthropic, or Ollama/vLLM SDK client at IronWarden to get real-time streaming PII redaction, sliding-window SSE token rehydration, prompt injection defense, and cryptographic HMAC-SHA256 audit chaining — with zero code changes in your application.

[ Client / Microservices / OpenAI & Anthropic SDKs ]

│

▼ (HTTP/2, Streaming SSE, JSON-RPC)

┌─────────────────────────────────────────────────────────────┐

│ IronWarden Core Gateway │

│ │

│ ┌──────────────────┐ ┌────────────────────────────────┐ │

│ │ Token Bucket │ │ Axum / Hyper High-Concurrency │ │

│ │ GCRA Rate Limit │───▶│ Non-Blocking Connection Pool │ │

│ └──────────────────┘ └────────────────────────────────┘ │

│ │ │

│ ▼ │

│ ┌────────────────────────────────────────────────────────┐ │

│ │ Streaming SSE Rehydration Engine │ │

│ │ • Sliding-window token reassembly across chunk splits │ │

│ │ • Zero-copy string normalization & homoglyph defense │ │

│ └────────────────────────────────────────────────────────┘ │

│ │ │

│ ▼ │

│ ┌────────────────────────────────────────────────────────┐ │

│ │ Multi-Tier PII & Security Gating │ │

│ │ • Layer 1: SIMD-Accelerated Aho-Corasick Regex Rules │ │

│ │ • Layer 2: ShadowNer Named Entity Recognition │ │

│ │ • Layer 3: Prompt Injection & Smuggling Guardrail │ │

│ └────────────────────────────────────────────────────────┘ │

│ │ │

│ ▼ │

│ ┌────────────────────────────────────────────────────────┐ │

│ │ Tamper-Proof Audit Chaining (HMAC-SHA256 Merkle Chain) │ │

│ │ • Verifiable cryptographic audit trail for EU AI Act │ │

│ └────────────────────────────────────────────────────────┘ │

└───────────────────────────────┬─────────────────────────────┘

│ (Redacted Outbound TX)

▼

[ Upstream LLMs: OpenAI / Anthropic / Local Ollama ]

Spin up IronWarden in 5 seconds with zero configuration:

docker run -d --name ironwarden \

-p 8080:8080 \

-e UPSTREAM_LLM="https://api.openai.com" \

-e WARDEN_MODE="hybrid" \

ghcr.io/somnerd/ironwarden:latestSend an LLM prompt containing sensitive PII and observe instant streaming token restoration with zero telemetry leakage:

curl -X POST http://localhost:8080/v1/chat/completions \

-H "Content-Type: application/json" \

-H "Authorization: Bearer YOUR_API_KEY" \

-d '{

"model": "gpt-4o",

"messages": [

{"role": "user", "content": "Process payment for John Doe, SSN 000-12-3456, IBAN GR1201101250000000012345678."}

],

"stream": true

}'docker compose up -dhelm install ironwarden ./deploy/helm/ironwarden \

--set secrets.wardenPepper="0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef" \

--set secrets.openaiApiKey="sk-..."git clone https://github.com/Somnerd/IronWarden.git

cd IronWarden

# Optional: Download ONNX NER weights (falls back to high-speed heuristic mode if omitted)

./scripts/setup_models.sh

# Run the gateway

export WARDEN_PEPPER=$(openssl rand -hex 16)

cargo run --release -p appSimply set base_url to IronWarden's gateway endpoint:

from openai import OpenAI

# Point client to IronWarden — zero code modifications required

client = OpenAI(

api_key="sk-mock-or-real",

base_url="http://localhost:14141/v1",

default_headers={"Authorization": "Bearer <your-jwt-or-key>"}

)

response = client.chat.completions.create(

model="gpt-4o",

messages=[

{"role": "user", "content": "Patient John Doe (SSN: 123-45-6789) shows elevated blood pressure."}

],

stream=True # Streaming supported natively with real-time SSE token rehydration

)

for chunk in response:

if chunk.choices[0].delta.content:

print(chunk.choices[0].delta.content, end="", flush=True)

# ✅ PII scrubbed before reaching upstream LLM

# ✅ HMAC-chained tamper-evident audit record logged

# ✅ PII seamlessly restored in the output streamimport anthropic

client = anthropic.Anthropic(

api_key="sk-ant-...",

base_url="http://localhost:14141",

default_headers={

"Authorization": "Bearer <your-jwt-or-key>",

"X-IronWarden-Upstream-Key": "sk-ant-..."

}

)

message = client.messages.create(

model="claude-3-5-sonnet-20241022",

max_tokens=1024,

messages=[{"role": "user", "content": "Customer Jane Smith (Email: jane@enterprise.com) requested a refund."}]

)

print(message.content[0].text)Automatic Model Routing:

- claude-*➔ Anthropic API (- https://api.anthropic.com/v1/messages)

- llama*,- mistral*,- phi*,- gemma*,- qwen*➔ Local Ollama (- http://localhost:11434/v1/chat/completions)

- All other models ➔ OpenAI API (https://api.openai.com/v1/chat/completions)

Unlike standard proxies that buffer the entire response to replace tokens (introducing massive latency and breaking streaming UI), IronWarden implements an asynchronous SSE sliding-window state machine (SseRehydrator). It dynamically stitches split tokens across partial HTTP chunks in under 0.04 ms per chunk.

- Deterministic Layer (Aho-Corasick + Entropy Smuggling Protection): Ultra-fast regex and entropy heuristics for Credit Cards, SSNs, Emails, Phone Numbers, IBANs, and International IDs (including Greek AMKA/AFM and EU identifiers).

- Probabilistic Layer (Local ONNX NER): In-process DistilBERT Named Entity Recognition for contextual Names, Organizations, and Locations.

- AES-256-GCM Encryption: Prompt and redaction records are encrypted at rest using your cryptographic pepper.

- HMAC-SHA256 Hash Chaining: Every log entry is cryptographically linked to the previous record with continuous full-chain integrity walk verification.

- Fail-Closed Security: If storage fills up or audit logging fails, IronWarden physically halts upstream egress to prevent un-audited data leakage.

Pre-configured, zero-touch regulatory rule sets ready to deploy:

- Middle East & GCC Sovereignty (config/rules/me.yaml): Saudi Arabia PDPL (SDAIA), UAE Federal Decree-Law No. 45/2021, Qatar. Emirates ID, Saudi National ID/Iqama, Saudi & UAE IBANs, GCC mobile numbers, Arabic name heuristics.

- East Asia Sovereignty (config/rules/east_asia.yaml): China PIPL / CSL, Japan APPI, South Korea PIPA, Singapore PDPA. China Resident ID, USCC, China Mobile, Japan My Number, Korea RRN, Singapore NRIC.

- India DPDP Act 2023 (config/rules/in.yaml): PAN cards, Aadhaar numbers, GSTIN, Voter ID (EPIC), Indian Passports, Indian Mobile.

- GDPR & European Sovereignty (config/rules/eu.yaml,config/rules/gr.yaml): EU & Greek national IDs (AMKA, AFM), EU IBANs, Passports, Driving Licenses.

- HIPAA (config/rules/rules_medical.yaml): Medical records, Patient IDs, MRNs, SSNs.

- PCI-DSS (config/rules/rules.yaml): Primary Account Numbers (PANs), CVVs, track data.

IronWarden includes a native JSON-RPC 2.0 stdio MCP server for agentic AI architectures (Claude Desktop, Cursor, AI agents) with session isolation and prompt sanitization tools:

- mcp_sanitize_prompt

- mcp_restore_prompt

- mcp_get_compliance_report

Measured using Criterion.rs with 1,000+ iterations per sample. See BENCHMARKS.md for full methodology.

IronWarden includes native, production-grade observability:

- Prometheus Metrics: GET /metricsexposes request counts, blocked prompt injections, redacted PII entities, and available concurrency permits.

- Turnkey Grafana Dashboard: GET /grafana/dashboardexports the pre-configured Grafana dashboard JSON.

- Structured Health Inspection: GET /healthreturns JSON uptime, permit availability, and system status.

Launch IronWarden + Prometheus + Grafana together:

docker compose -f monitoring/docker-compose.monitoring.yml up -dVisit http://localhost:3000 (admin/admin) to view real-time gateway traffic, blocked prompt injection attacks, and redacted PII statistics.

I partner with engineering teams and startups on fractional consulting and dedicated infrastructure sprints:

- The 1-Week Sovereign AI Gateway Sprint (€4,500 flat fee): VPC deployment, custom PII rules, and <0.1ms streaming latency.

- Custom Rust Reverse Proxies & Protocol Gateways (HTTP/2, Tokio, Axum, L2.5–L7 signaling).

- Backend Performance Audits & Python-to-Rust Migrations.

- Contributing: Please read our CONTRIBUTING.md and CODE_OF_CONDUCT.md.

- Security Disclosures: For vulnerability reporting, please see SECURITY.md.

- Maintainer Notes: See MAINTAINER_NOTES.md.

- License: Licensed under the MIT License. 100% free and open-source software for commercial and private use.

- Enterprise Services & Support: For custom PII rule modeling, compliance readiness, or dedicated architecture sprints, see LICENSE-COMMERCIAL.md.

- Copyright: Copyright (c) 2026 IronWarden Maintainers.