Integrate, configure, and deploy DFENS.
DFENS is a self-hosted application firewall for LLM traffic, the engine built
in the ai-firewall repository. It inspects prompts, model responses,
and tool-result content against declarative rules, and it runs entirely on your
own hardware. This section is for the engineers who adopt it.
DFENS is in private early access. The container image is distributed through a
private registry to approved design partners. It is not on any public registry
yet. Request access
to be issued a registry credential and an image reference; the examples below use
REGISTRY/ai-firewall:<tag> as a placeholder for it.
API integration
Two integration paths: the transparent reverse proxy and the in-app
/v1/inspect endpoint. Request and response schemas, block
behaviour, and streaming semantics.
Configuration
The YAML schema, environment-variable overrides, upstream auth modes, providers, audit, and metrics, with the defaults that ship in the image.
03 · DeployDeployment
From a single docker run to Docker Compose to a hardened
Kubernetes manifest set. Probes, state, and the network isolation the
proxy requires.
OWASP LLM Top 10
What the default rule set detects, mapped to the 2025 OWASP LLM Top 10, on the main site.
How it fits into your stack
There are two ways to put DFENS in the path of a model call, and they share one rule engine and one audit log:
- Reverse proxy. DFENS speaks the OpenAI and Anthropic wire formats (plus Azure OpenAI, AWS Bedrock, and Google Gemini/Vertex on their native routes). Point your SDK's base URL at DFENS and every request, response, and tool call is inspected transparently. No code changes.
- In-app inspection. When you can't sit a proxy in the network
path, call
POST /v1/inspectfrom your own code with a prompt, a response, or a tool result, and act on theallow/denyverdict it returns.
Secure the data plane on two layers. DFENS can require callers to
present a client token (the X-AI-Firewall-Key header, see
client authentication), and it's
still meant to run on a trusted network segment (private network, or a Kubernetes
NetworkPolicy). Treat these as defense-in-depth: turn on the client token and
keep the listener off untrusted networks. Client auth is opt-in, so if you haven't
configured a token the proxy accepts any caller that can reach it.
Start with API integration if you want to send your first blocked request, or jump to Deployment to get an instance running first.