Installation
Guards are included in the main QWED SDK:Available guards
| Guard | Purpose |
|---|---|
RAGGuard | Prevents Document-Level Retrieval Mismatch (DRM) in RAG pipelines |
ExfiltrationGuard | Blocks data exfiltration to unauthorized endpoints |
MCPPoisonGuard | Detects poisoned MCP tool definitions |
SelfInitiatedCoTGuard | Verifies autonomous reasoning paths |
SovereigntyGuard | Enforces data residency policies |
ProcessVerifier | Validates IRAC structure and milestone completion |
SystemGuard | Validates shell commands |
ConfigGuard | Scans configuration for exposed secrets |
RAGGuard
Prevents Document-Level Retrieval Mismatch (DRM) hallucinations by verifying that retrieved chunks originate from the expected source document.Parameters
Maximum tolerable fraction of mismatched chunks. Use
Fraction for symbolic precision. Floats are rejected.If
True, chunks missing document_id in metadata are treated as mismatches.Methods
verify_retrieval_context(target_document_id, retrieved_chunks) - Verify all chunks belong to the target document.
filter_valid_chunks(target_document_id, retrieved_chunks) - Return only chunks that match the target document.
ExfiltrationGuard
Prevents compromised agents from sending sensitive data to unauthorized endpoints. Acts as a runtime control policy layer.Parameters
URL prefixes or hostnames that agents can call. Pass
[] to block all outbound calls. If None, uses a safe default list of AI API endpoints.Subset of PII types to scan for. Available types:
SSN, CREDIT_CARD, EMAIL, PHONE_US, PASSPORT, IBAN, AWS_ACCESS_KEY, PRIVATE_KEY, JWT, BEARER_TOKEN. Default enables all except PASSPORT.Additional
{name: regex_string} patterns to detect.Methods
verify_outbound_call(destination_url, payload, method) - Verify an outbound API call before execution.
scan_payload(payload) - Standalone PII scan without endpoint check.
Detected PII types
- Social Security Numbers (SSN)
- Credit card numbers (Visa, MasterCard, Amex, Discover)
- Email addresses
- US phone numbers
- IBAN numbers
- AWS access keys
- Private keys (RSA/EC)
- JWT tokens
- Bearer tokens
MCPPoisonGuard
Detects poisoned or tampered Model Context Protocol (MCP) tool definitions before agent execution. Scans for prompt injection attempts and unauthorized URLs.Parameters
Hostnames permitted in tool descriptions. Defaults to common AI API domains.
Additional regex patterns to detect injection attempts.
Also scan parameter descriptions and enum values.
Methods
verify_tool_definition(tool_schema) - Scan a single MCP tool schema.
verify_server_config(server_config) - Scan an entire MCP server configuration.
Detected patterns
<important>,<system>,<instruction>tags- “Ignore previous instructions” variants
- “You are now a…” jailbreak attempts
- “DAN mode” references
- Unauthorized external URLs
SelfInitiatedCoTGuard
Verifies Self-Initiated Chain-of-Thought (S-CoT) reasoning paths. Ensures that AI-generated reasoning plans contain all required domain checkpoints before execution.Parameters
List of milestones/nodes that must be present in the AI’s reasoning plan. All elements must be non-empty strings.
Methods
verify_autonomous_path(generated_reasoning_plan) - Validates the structure of an AI-generated reasoning plan.
SovereigntyGuard
Enforces data residency and sovereignty policies. Prevents sensitive data from being routed to external cloud providers.Parameters
List of provider names considered “local” and safe for sensitive data.
Methods
verify_routing(prompt, target_provider) - Verify that a prompt can be safely routed to the target provider.
Detected sensitive patterns
- Social Security Numbers (dash-separated, space-separated, contiguous)
CONFIDENTIALmarkers
IRAC audit fields
All guards return IRAC-compliant audit fields for compliance reporting:ProcessVerifier
Validates the structural integrity and process adherence of AI reasoning traces. Ensures workflows follow deterministic process steps using IRAC pattern matching and milestone validation.Methods
verify_irac_structure(reasoning_trace) - Checks for Issue, Rule, Application, and Conclusion components. Returns a decimal score (0.0-1.0) and list of missing steps.
verify_trace(text, key_middle) - Verifies presence of required milestones/keywords. Returns process rate and missed milestones.
See the Process Verifier page for detailed documentation.