ReskSafety · Documentation

Self-hosted LLM firewall

ReskSafety is the deployable part of the RESK stack: an OpenAI- and Anthropic-compatible firewall you host yourself, with capability-based RBAC, editable policies, optional logits-level filtering and reversible masking of secrets and PII.

• Version 0.1.1
• FastAPI + React
• Python 3.11+
• Apache-2.0

What it is

ReskSafety sits between your application and an LLM provider. Applications keep calling a familiar chat API; RESK decides what is allowed to leave, what the model is allowed to emit, and records what happened.

• Drop-in endpoints. POST /v1/chat/completions speaks the OpenAI schema; POST /v1/messages speaks the Anthropic schema, including x-api-key authentication so the Anthropic SDK works unchanged.
• Capability RBAC. Every role owns a 64-bit mask. Bits gate concrete powers such as calling tools, reading PII or administering users; the mask never reaches the provider.
• Per-user policies. Banned phrases, hard/bias modes, jailbreak patterns, scanning levels, logit rules and memory-injection rules are compiled per request.
• Local logits filtering. With a local backend and resklogits, banned tokens are suppressed during generation — not after the fact.
• ENV Match. Secrets and PII are replaced by [[RESK_*]] flags before egress and restored locally in the response, so the provider never receives the original value.
• Audit by default. Requests, blocks, sessions and admin actions are stored and exposed in the console (/api/admin/logs, /api/admin/stats).

Architecture

client / agent / SDK
        │  Bearer JWT · cookie · x-api-key
        ▼
┌──────────────────────────────────────────────┐
│ ReskSafety backend (FastAPI :8000)           │
│                                              │
│  auth ─▶ RBAC mask ─▶ policy compile         │
│            │                                 │
│            ├─ input scans (injection, jailbreak, banned phrases)
│            ├─ ENV Match  (secrets/PII → flags)
│            ├─ provider routing (X-Provider-Id)
│            ├─ upstream call ─▶ OpenAI / vLLM / Ollama / Anthropic
│            ├─ output filter · logits (local)
│            └─ ENV Match restore (flags → values)
│                                              │
│  SQLAlchemy ─▶ PostgreSQL (or SQLite)        │
└──────────────────────────────────────────────┘
        ▲
        │ admin console (React :3000)
        └─ users · roles · policies · providers · sessions · logs

Quick start

Docker Compose (production shape)

git clone https://github.com/Resk-Security/ReskSafety.git resk
cd resk

cat > .env <<'EOF'
JWT_SECRET_KEY=$(openssl rand -hex 32)
CSRF_SECRET=$(openssl rand -hex 32)
PROVIDER_ENCRYPTION_KEY=$(openssl rand -base64 32)
DB_PASSWORD=$(openssl rand -hex 16)
LLM_BACKEND_URL=https://api.openai.com/v1
LLM_BACKEND_API_KEY=sk-...
EOF

docker compose up -d --build

Backend on http://localhost:8000, console on http://localhost:3000, PostgreSQL in the db service. The first startup seeds the schema, an admin account with password changeme, the capability catalogue and default roles — change that password immediately.

Local development

./start.sh        # creates backend/.venv, seeds SQLite, starts FastAPI + Vite

Check that the backend is alive:

curl -s http://localhost:8000/health

Endpoints

The security layers, in order

1. Authentication — JWT cookie for the console, bearer token or x-api-key for API clients. A user's roles are resolved on every request.

2. RBAC — the merged capability mask is checked against what the request asks for. Tool calling requires bit 0; PII access is its own bit.

3. Policy compilation — banned phrases, jailbreak patterns and logit rules are compiled once per request for the active policies.

4. Input screening — resk2 semantic scanning (configurable per policy), jailbreak substring list and policy phrase matching. A hit returns 403 and is logged.

5. ENV Match — secrets and PII are replaced by stable flags before the payload leaves the process. See ENV Match.

6. Generation — provider call, or in-process generation with resklogits when the backend is local. Token bans happen during decoding.

7. Output control — post-filtering for distant providers; for local generation the logits processor already prevented banned tokens. ENV Match restores flags in the text and tool arguments.

8. Audit — status, model, backend, policy, blocked phrase, masked prompt hash and request metadata are persisted.

Limits and license

• Not a sandbox. ReskSafety mediates the LLM boundary. It does not sandbox tool execution, filesystem access or the agent runtime.
• Patterns are heuristics. Phrase lists, regexes and the resk2 detectors catch known shapes; they are one layer of a defence-in-depth design.
• Distant providers cannot suppress tokens. OpenAI/vLLM/Ollama/Anthropic paths rely on post-filtering (the response is already generated); use a local backend if you need decoding-time bans.
• One deployment, many tenants by policy. Users, roles and policies are isolated inside one instance; there is no multi-tenant control plane.
• License. Apache-2.0 since 0.1.1 — free to use, modify and redistribute with the licence notice. The LICENSE file is the reference.

Where to go next