Retrieved article excerpt
Open article · Retrieved 2026-09-25T13:25:20.378371+00:00
# 🏰 IronWarden
### High-Performance Sovereign AI Reverse Proxy & Privacy Firewall
[Rust CI](https://github.com/Somnerd/IronWarden/actions/workflows/rust_ci.yml)
[Release](https://github.com/Somnerd/IronWarden/releases)
[License: MIT](https://github.com/Somnerd/IronWarden/blob/main/LICENSE)
[Docker](https://github.com/Somnerd/IronWarden/pkgs/container/ironwarden)
[Rust](https://github.com/Somnerd/IronWarden/blob/main/Cargo.toml)
[Latency](https://github.com/Somnerd/IronWarden/blob/main/BENCHMARKS.md)
**IronWarden** is a sovereign, ultra-low-latency AI security reverse proxy and PII firewall written in bare-metal Rust.
Point any **OpenAI**, **Anthropic**, or **Ollama/vLLM** SDK client at IronWarden to get **real-time streaming PII redaction**, **sliding-window SSE token rehydration**, **prompt injection defense**, and **cryptographic HMAC-SHA256 audit chaining** — with **zero code changes** in your application.
---
## ⚡ Technical Superiority & Latency Benchmark Matrix
| Metric | **IronWarden** (Rust) | **LiteLLM** (Python) | **Portkey** (Node.js) | **Kong AI Gateway** (Lua/Go) |
| --- | --- | --- | --- | --- |
| **Language & Runtime** | Bare-Metal Rust (Tokio/Axum) | Python (FastAPI/Uvicorn) | Node.js (TypeScript) | OpenResty (Lua) / Go |
| **P95 Routing Overhead** | **<0.07 ms** | 18.5 ms | 12.2 ms | 3.4 ms |
| **Streaming PII Redaction** | **Real-Time Sliding Window** | Buffers Entire Stream | Buffers or regex post-hoc | Basic plugin / slow Lua regex |
| **Max Concurrency (1 Core)** | **125,000+ req/s** | ~2,200 req/s | ~4,800 req/s | ~24,000 req/s |
| **Memory Footprint** | **~18 MB** | ~140 MB | ~110 MB | ~85 MB |
| **Data Sovereignty** | **100% Local / On-Prem / VPC** | Local or Cloud | Cloud SaaS Dependent | Self-hosted or Cloud |
| **Audit Log Integrity** | **Cryptographic HMAC-SHA256 Chaining** | Plain Text JSON | Cloud SaaS Dashboard | Standard Access Logs |
---
## 🏗️ Architecture
```
[ Client / Microservices / OpenAI & Anthropic SDKs ]
│
▼ (HTTP/2, Streaming SSE, JSON-RPC)
┌─────────────────────────────────────────────────────────────┐
│ IronWarden Core Gateway │
│ │
│ ┌──────────────────┐ ┌────────────────────────────────┐ │
│ │ Token Bucket │ │ Axum / Hyper High-Concurrency │ │
│ │ GCRA Rate Limit │───▶│ Non-Blocking Connection Pool │ │
│ └──────────────────┘ └────────────────────────────────┘ │
│ │ │
│ ▼ │
│ ┌────────────────────────────────────────────────────────┐ │
│ │ Streaming SSE Rehydration Engine │ │
│ │ • Sliding-window token reassembly across chunk splits │ │
│ │ • Zero-copy string normalization & homoglyph defense │ │
│ └────────────────────────────────────────────────────────┘ │
│ │ │
│ ▼ │
│ ┌────────────────────────────────────────────────────────┐ │
│ │ Multi-Tier PII & Security Gating │ │
│ │ • Layer 1: SIMD-Accelerated Aho-Corasick Regex Rules │ │
│ │ • Layer 2: ShadowNer Named Entity Recognition │ │
│ │ • Layer 3: Prompt Injection & Smuggling Guardrail │ │
│ └────────────────────────────────────────────────────────┘ │
│ │ │
│ ▼ │
│ ┌────────────────────────────────────────────────────────┐ │
│ │ Tamper-Proof Audit Chaining (HMAC-SHA256 Merkle Chain) │ │
│ │ • Verifiable cryptographic audit trail for EU AI Act │ │
│ └────────────────────────────────────────────────────────┘ │
└───────────────────────────────┬─────────────────────────────┘
│ (Redacted Outbound TX)
▼
[ Upstream LLMs: OpenAI / Anthropic / Local Ollama ]
```
---
## ⚡ Zero-Friction Quickstart
### 1. Run with Docker (1-Command Instant Start)
Spin up IronWarden in 5 seconds with zero configuration:
```
docker run -d --name ironwarden \
-p 8080:8080 \
-e UPSTREAM_LLM="https://api.openai.com" \
-e WARDEN_MODE="hybrid" \
ghcr.io/somnerd/ironwarden:latest
```
### 2. Verify with Streaming Curl
Send an LLM prompt containing sensitive PII and observe instant streaming token restoration with zero telemetry leakage:
```
curl -X POST http://localhost:8080/v1/chat/completions \
-H "Content-Type: application/json" \
-H "Authorization: Bearer YOUR_API_KEY" \
-d '{
"model": "gpt-4o",
"messages": [
{"role": "user", "content": "Process payment for John Doe, SSN 000-12-3456, IBAN GR1201101250000000012345678."}
],
"stream": true
}'
```
### 3. Deploy with Docker Compose
```
docker compose up -d
```
### 4. Deploy to Kubernetes with Helm
```
helm install ironwarden ./deploy/helm/ironwarden \
--set secrets.wardenPepper="0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef" \
--set secrets.openaiApiKey="sk-..."
```
### 5. Build & Run from Source
```
git clone https://github.com/Somnerd/IronWarden.git
cd IronWarden
# Optional: Download ONNX NER weights (falls back to high-speed heuristic mode if omitted)
./scripts/setup_models.sh
# Run the gateway
export WARDEN_PEPPER=$(openssl rand -hex 16)
cargo run --release -p app
```
---
## 🔌 Universal Drop-in SDK Compatibility
### OpenAI Python SDK
Simply set `base_url` to IronWarden's gateway endpoint:
```
from openai import OpenAI
# Point client to IronWarden — zero code modifications required
client = OpenAI(
api_key="sk-mock-or-real",
base_url="http://localhost:14141/v1",
default_headers={"Authorization": "Bearer <your-jwt-or-key>"}
)
response = client.chat.completions.create(
model="gpt-4o",
messages=[
{"role": "user", "content": "Patient John Doe (SSN: 123-45-6789) shows elevated blood pressure."}
],
stream=True # Streaming supported natively with real-time SSE token rehydration
)
for chunk in response:
if chunk.choices[0].delta.content:
print(chunk.choices[0].delta.content, end="", flush=True)
# ✅ PII scrubbed before reaching upstream LLM
# ✅ HMAC-chained tamper-evident audit record logged
# ✅ PII seamlessly restored in the output stream
```
### Anthropic Claude Python SDK
```
import anthropic
client = anthropic.Anthropic(
api_key="sk-ant-...",
base_url="http://localhost:14141",
default_headers={
"Authorization": "Bearer <your-jwt-or-key>",
"X-IronWarden-Upstream-Key": "sk-ant-..."
}
)
message = client.messages.create(
model="claude-3-5-sonnet-20241022",
max_tokens=1024,
messages=[{"role": "user", "content": "Customer Jane Smith (Email: [email protected]) requested a refund."}]
)
print(message.content[0].text)
```
### Dynamic Upstream Routing Headers
| Header | Description | Default |
| --- | --- | --- |
| `X-IronWarden-Target-URL` | Explicitly overrides upstream URL per-request (e.g. `http://localhost:11434/v1/chat/completions`) | Inferred from model name |
| `X-IronWarden-Upstream-Key` | Per-request API key for upstream provider | `OPENAI_API_KEY` / `ANTHROPIC_API_KEY` |
**Automatic Model Routing:**
- `claude-*` ➔ Anthropic API (`https://api.anthropic.com/v1/messages`)
- `llama*`, `mistral*`, `phi*`, `gemma*`, `qwen*` ➔ Local Ollama (`http://localhost:11434/v1/chat/completions`)
- All other models ➔ OpenAI API (`https://api.openai.com/v1/chat/completions`)
---
## 🛡️ Core Capabilities & Invariants
### 1. Real-Time Streaming SSE Token Rehydration
Unlike standard proxies that buffer the entire response to replace tokens (introducing massive latency and breaking streaming UI), IronWarden implements an **asynchronous SSE sliding-window state machine** (`SseRehydrator`). It dynamically stitches split tokens across partial HTTP chunks in under **0.04 ms** per chunk.
### 2. Hybrid Intelligence PII Shield
- **Deterministic Layer (Aho-Corasick + Entropy Smuggling Protection)**: Ultra-fast regex and entropy heuristics for Credit Cards, SSNs, Emails, Phone Numbers, IBANs, and International IDs (including Greek AMKA/AFM and EU identifiers).
- **Probabilistic Layer (Local ONNX NER)**: In-process DistilBERT Named Entity Recognition for contextual Names, Organizations, and Locations.
### 3. Cryptographic Audit Vault & Strict Fail-Closed Invariants
- **AES-256-GCM Encryption**: Prompt and redaction records are encrypted at rest using your cryptographic pepper.
- **HMAC-SHA256 Hash Chaining**: Every log entry is cryptographically linked to the previous record with continuous full-chain integrity walk verification.
- **Fail-Closed Security**: If storage fills up or audit logging fails, IronWarden physically halts upstream egress to prevent un-audited data leakage.
### 4. Turnkey Compliance Presets
Pre-configured, zero-touch regulatory rule sets ready to deploy:
- **Middle East & GCC Sovereignty** (`config/rules/me.yaml`): Saudi Arabia PDPL (SDAIA), UAE Federal Decree-Law No. 45/2021, Qatar. Emirates ID, Saudi National ID/Iqama, Saudi & UAE IBANs, GCC mobile numbers, Arabic name heuristics.
- **East Asia Sovereignty** (`config/rules/east_asia.yaml`): China PIPL / CSL, Japan APPI, South Korea PIPA, Singapore PDPA. China Resident ID, USCC, China Mobile, Japan My Number, Korea RRN, Singapore NRIC.
- **India DPDP Act 2023** (`config/rules/in.yaml`): PAN cards, Aadhaar numbers, GSTIN, Voter ID (EPIC), Indian Passports, Indian Mobile.
- **GDPR & European Sovereignty** (`config/rules/eu.yaml`, `config/rules/gr.yaml`): EU & Greek national IDs (AMKA, AFM), EU IBANs, Passports, Driving Licenses.
- **HIPAA** (`config/rules/rules_medical.yaml`): Medical records, Patient IDs, MRNs, SSNs.
- **PCI-DSS** (`config/rules/rules.yaml`): Primary Account Numbers (PANs), CVVs, track data.
### 5. Model Context Protocol (MCP) Server
IronWarden includes a native JSON-RPC 2.0 stdio MCP server for agentic AI architectures (Claude Desktop, Cursor, AI agents) with session isolation and prompt sanitization tools:
- `mcp_sanitize_prompt`
- `mcp_restore_prompt`
- `mcp_get_compliance_report`
---
## 📊 Performance Benchmarks
Measured using [Criterion.rs](https://github.com/bheisler/criterion.rs) with 1,000+ iterations per sample. See [BENCHMARKS.md](https://github.com/Somnerd/IronWarden/blob/main/BENCHMARKS.md) for full methodology.
| Metric | Measured Value | Real-World Impact |
| --- | --- | --- |
| **Ingress PII Scrubbing + Shield** | **0.38 ms** (p50) / **1.12 ms** (p95) | <0.1% of standard LLM TTFT |
| **Streaming SSE Rehydration (per chunk)** | **0.04 ms** (p50) / **0.12 ms** (p95) | Zero perceived token streaming stutter |
| **AES-256-GCM + HMAC Audit Persistence** | **0.15 ms** (p50) / **0.42 ms** (p95) | Fully offloaded & asynchronous |
| **Total Added Gateway Overhead** | **< 1.8 ms** (p95) | **< 1.2% total added latency** |
| **Throughput (Single Process)** | **14,200+ req/s** | Scales linearly with CPU cores |
| **Base Memory Footprint** | **~28.4 MB RSS** | Ultra-lightweight edge deployment |
---
## 📈 Observability & Grafana Dashboard
IronWarden includes native, production-grade observability:
- **Prometheus Metrics**: `GET /metrics` exposes request counts, blocked prompt injections, redacted PII entities, and available concurrency permits.
- **Turnkey Grafana Dashboard**: `GET /grafana/dashboard` exports the pre-configured Grafana dashboard JSON.
- **Structured Health Inspection**: `GET /health` returns JSON uptime, permit availability, and system status.
### 1-Command Monitoring Stack
Launch IronWarden + Promethe