ReskSafety: The Deployable Open-Source LLM Firewall

Libraries protect your code. But sooner or later, every team needs a central, deployable enforcement point for LLM security: one place where policies live, where access control is applied, and where every model call is logged. That is exactly what ReskSafety is — and you can try a full deployment right now at demo.resk.fr.

What Is ReskSafety?

ReskSafety is a full-stack, self-hostable LLM firewall built on FastAPI and React. It exposes an OpenAI-compatible endpoint (POST /v1/chat/completions, plus Anthropic-compatible /v1/messages): you point your existing applications at it, and every request passes through the firewall before reaching your model backend. No SDK rewrite, no code changes — just a base URL swap. The conceptual background is in our LLM firewall guide; this article is the product tour.

The Request Path

Every call through ReskSafety goes through the same five stages, in order, regardless of which application or SDK originated it:

The key property is that none of these stages can be skipped by the calling application — they live in the deployed control point, not in an importable library. That is the difference between detection embedded in code and enforcement in the request path.

RBAC with 64-bit Capability Bitmasks

Every role carries a 64-bit capability bitmask. Each bit is a capability — tool calling, code generation, database access, email sending, PII handling, user management, system configuration — and filtering policies attach to masks. Security is enforced per role, not globally: a support agent, a developer, and an admin can share the same model and the same endpoint while receiving different allowances on every request.

Capabilities are editable at runtime from the admin console or the API — the same partial-update endpoint that powers the console's role matrix:

Editable Filtering Policies

Banned phrases, hard-block and bias (penalty) enforcement modes, and confidence thresholds are all editable from the console — no redeploy to change what gets filtered. Policies are stored in the database and bridge down to resk-logits, our GPU-accelerated logits processor, for token-level enforcement: dangerous content is not just flagged after generation, it becomes statistically impossible to generate (shadow-ban filtering explained). Input-time scanning catches what it can; the generation-time filter holds even when an injection gets through.

Tool-Call Authorization

Agent tool calls are checked against the caller's capability mask and MCP tool allowlists before execution. Unauthorized calls fail closed — the agent does not get to "try" a database query or an email send unless its role grants that capability. This is the control that makes prompt injection survivable: injection can change what the model attempts, but not what the deployment permits.

Multi-Provider Routing

Route requests to any OpenAI-compatible backend — OpenAI, vLLM, Ollama, or your own gateway — via the X-Provider-Id header or admin configuration. One firewall in front of every model you run: switch providers behind it without touching application code, and keep one policy and audit surface across all of them.

Admin Console and Audit

Users, roles, policies, providers, agent sessions, logs, stats, and an audit trail — with a D3 network graph to visualize the deployment topology. Requests are logged with user identity, policy hits, and outcome; agent sessions are tracked end-to-end and exportable to your observability stack via ReskPoints (Datadog, Prometheus, OpenTelemetry). Authentication uses JWT in httpOnly cookies with Argon2 password hashing and CSRF protection.

Deploy It

ReskSafety is source-available under the RESK Software License on GitHub: Resk-Security/ReskSafety. The stack is the FastAPI backend, a React 18 + Vite frontend, and PostgreSQL (SQLite for quick starts):

The full walkthrough — from clone to enforced policies — is in Self-Host an LLM Firewall with Docker in Minutes. If you would rather see it first, use the hosted instance below.

Try the Live Demo

A full deployment of ReskSafety is running at demo.resk.fr. Sign up, explore the admin console, edit a filtering policy, toggle a capability on the role matrix, and watch the firewall enforce it in real time.

Where It Fits in the RESK Ecosystem

ReskSafety is the application layer of the RESK stack: resk-logits provides the token-level filtering engine, reskSecure the per-user Python firewall, resk-llm and resk-llm-ts the in-code detection libraries, and ReskPoints the agent logging that ReskSafety bridges to. Explore all of them on our open-source tools page. For the deployment-model questions — self-hosted vs managed, governance, compliance — see the enterprise AI security hub.