Developer documentation

Integrate, configure, and deploy DFENS.

DFENS is an application firewall for LLM traffic, the engine built in the ai-firewall repository. It inspects prompts, model responses, and tool-result content against declarative rules. These pages cover running it yourself, on your own hardware or in your VPC, which is an Enterprise-tier deployment. The same engine backs DFENS Cloud, where we operate it for you. This section is for the engineers who adopt it.

Private registry

The self-hosted container image is distributed through a private registry to approved Enterprise customers and design partners; it is not on any public registry yet. Request access to be issued a registry credential and an image reference; the examples below use REGISTRY/ai-firewall:<tag> as a placeholder for it.

01 · Integrate

API integration

Two integration paths: the transparent reverse proxy and the in-app /v1/inspect endpoint. Request and response schemas, block behaviour, and streaming semantics.

02 · Configure

Configuration

The YAML schema, environment-variable overrides, upstream auth modes, providers, audit, and metrics, with the defaults that ship in the image.

03 · Deploy

Deployment

From a single docker run to Docker Compose to a hardened Kubernetes manifest set. Probes, state, and the network isolation the proxy requires.

Reference

OWASP LLM Top 10

What the default rule set detects, mapped to the 2025 OWASP LLM Top 10, on the main site.

How it fits into your stack

There are two ways to put DFENS in the path of a model call, and they share one rule engine and one audit log:

Reverse proxy. DFENS speaks the OpenAI and Anthropic wire formats (plus Azure OpenAI, AWS Bedrock, and Google Gemini/Vertex on their native routes). Point your SDK's base URL at DFENS and every request, response, and tool call is inspected transparently. No code changes.
In-app inspection. When you can't sit a proxy in the network path, call POST /v1/inspect from your own code with a prompt, a response, or a tool result, and act on the allow/deny verdict it returns.

Read this first

Secure the data plane on two layers. DFENS can require callers to present a client token (the X-AI-Firewall-Key header, see client authentication), and it's still meant to run on a trusted network segment (private network, or a Kubernetes NetworkPolicy). Treat these as defense-in-depth: turn on the client token and keep the listener off untrusted networks. Client auth is opt-in, so if you haven't configured a token the proxy accepts any caller that can reach it.

Start with API integration if you want to send your first blocked request, or jump to Deployment to get an instance running first.