A local safety layer for AI outputs and agent actions.
Guardian checks AI outputs and agent actions against rules you choose, on your machine, and returns pass, fail or uncertain.
Guardian benefits
-
Local-First Privacy
Core safety checks run and stay on your device. No account needed. You supply the hardware and models.
-
Works Offline
After one-time setup, core safety checks run offline. Air-gap compatible.
-
Open Source
Read the code, change it, contribute back. Free to run, locally or with your own model key. Each check records the constitution hash, judge model, and prompt version behind its verdict.
-
Deterministic Prescreen
A deterministic pattern prescreen flags known risks before the model runs; fixed high-risk patterns are blocked without an LLM call. The model handles the rest.
Same engine, two ways to use it
The app handles personal and institutional checks. The Python API returns pass, fail, or uncertain for an agent action before it runs. Uncertain actions are not allowed unless you configure cloud escalation, and a result can carry a suggested alternative action.
2.1.0 not yet on PyPI: PyPI currently serves only the unsafe 0.1.1 preview. The pinned 2.1.0 command will fail until the repaired candidate is published and verified.
Both run the same safety checks on your device. Downloads, updates, sign-in, cloud sync, and external links may use the network.
Four paths, one safety engine
Guardian Layer for Agents
Agent-platform developers, agent team leads, and safety engineers
A safety gate between your agent and risky actions: tool calls, context changes, and policy updates.
- Job
- Place Guardian between your agent and its actions. Every tool call, message, and context change gets evaluated before it runs.
- Recommended mode
- custom
- Trust artifact
- Machine-readable record: action hash, applied rules, decision, and integration instructions.
Institutional AI Safety Governance
Public-interest teams, labs, schools, clinics, nonprofits, and accountable deployers
Written policies become testable safety checks. Every decision gets an auditable, exportable record.
- Job
- Turn written policies into testable safety checks, evaluate model and agent outputs against them, and export audit records.
- Recommended mode
- strict
- Trust artifact
- Decision record with policy hash, actor context, reasons, appeal route, and exportable JSON. Actions the hosted gateway authorizes also carry a signed decision token.
AI Safety Research
Researchers, lab leads, evaluators, and funder reviewers
Compare Guardian decisions across rule sets, reproduce results, and export records for peer review.
- Job
- Compare Guardian decisions with no custom rules, one rule, and multiple rules so safety claims can be inspected rather than trusted.
- Recommended mode
- balanced
- Trust artifact
- Decision record with rule stack, configuration, outcome, rationale, uncertainty estimate, and integrity hash.
Personal Companion Safety
People using companion AI, parents and caregivers, and wellbeing advocates
Safety checks for companion AI that respect user boundaries, explain changes, and let you challenge decisions.
- Job
- Set personal boundaries as rules, see why responses changed, and appeal decisions you disagree with.
- Recommended mode
- balanced
- Trust artifact
- Plain-language record: what was checked, which rule applied, the decision, and how to appeal it.
Agent frameworks: what works today
Works with Claude Code and any agent that accepts a system prompt.
- Claude Code
- works today through the system prompt.
- Hermes plugin
- constitution injection shipped; tool-call gate not yet public.
- OpenClaw
- built but not yet installable.
The usage guide walks through integration step by step, with agent-specific safety rules, copy-paste code examples, and rate-limit and cost-control patterns.
Usage guideThe Hermes plugin is creedspace-hermes; its optional tool-call gate (advisory or
enforce) needs a local policy server that is not yet public. OpenClaw support covers MCP
wiring plus a constitution template. Source: Hermes plugin on GitHub.
From local devices to servers
Five model tiers run from edge devices with 2GB of RAM to servers. Guardian can select a default tier based on available memory where supported, or you can choose one explicitly. Tier IDs are stable; the model behind each can change only in a versioned release. Larger tiers are not guaranteed to catch more. Every tier is free to run.
tier="1.5b"qwen3.5:2b · ~1.5GBtier="3b"qwen3.5:4b · ~2-3GBtier="7b"qwen3.5:9b · ~6GBtier="14b"qwen2.5:14b · ~9GBtier="32b"qwen2.5:32b · ~20GBCommon Questions
Is Guardian free?
Yes. Guardian is free. Run it locally or with your own model key. The core local code is Apache 2.0 licensed, and Creed Space never charges for checks or adds a markup to provider calls.
Do you collect any data?
Core Guardian evaluations run locally with no cloud logging. Optional account features only sync when you sign in. If you configure a BYOK cloud provider or cloud escalation, the checked text is sent to that provider or to the Creed Space cloud API.
App or library: which should I use?
Same technology. Use the app if you just want to check text. Use the library if you're building software.
What happens to uncertain cases?
Blocked by default (fail-closed). Connect your own cloud provider key to escalate edge cases to a larger model that weighs full context; your provider bills you for those calls directly.
Can I use Guardian commercially?
Yes. Apache 2.0 licensed. Use it in products, sell those products, no royalties. Keep the license and notices that ship with it.
How capable is the default local tier?
The default model (Qwen 3.5 4B) is the recommended tier for everyday safety checks. Larger tiers handle longer inputs and more ambiguous cases. Benchmarks are in progress and will be published when ready.
What runs without an LLM?
Guardian runs a deterministic pattern prescreen before the model. Fixed high-risk patterns are blocked without an LLM call; other pattern hits are passed to the model for review by default. The LLM is reserved for nuanced, context-dependent judgments.
What about Fleet?
Guardian runs locally on your hardware. Fleet adds centralised governance and team management from a hosted dashboard. Like the rest of Creed Space, Fleet is free; its model calls use your own provider key or a local model.
On-device vs Cloud
Guardian (On-device)
- Included: Apache 2.0 licensed local code
- Included: Core evaluations stay on your device
- Included: Works offline
- Included: Optional local JSON audit logs
- Limitation: Local models (smaller, less accurate on edge cases)
- Limitation: Manual rule-bundle updates (no live cloud sync)
Creed Space (Cloud)
- Included: Cloud or local models, your choice
- Included: Custom rules for your values and policies
- Included: Decisions use full conversation context, not just the last message
- Included: Audit logging and compliance-report design support. Exact deployment coverage, provider retention, legal interpretation, and independent assurance remain open.
- Included: Per-rule thresholds, role-based overrides, and escalation paths
- Included: Fleet management dashboard (deployment-specific)
- Included: No local model download required
Guardian runs on your device for private checks. Creed Space adds team governance, cloud models, and audit records. Coverage and retention terms vary by plan.