Guard Gateway

Route LLM calls through Scrimmage to block, mask, or redact PII and unsafe content in real time — before responses reach your users.

How it works

  1. Your app sends the LLM request to Scrimmage instead of directly to the provider
  2. Pre-guardrail: Tier 1 scans the user input for CRITICAL issues. If found, the request is blocked immediately — no LLM call is made.
  3. Scrimmage forwards the request to the LLM provider (using your API key or Scrimmage's)
  4. Post-guardrail: Tier 1 scans the LLM response. Depending on your PII config, it blocks, masks, or redacts flagged content.
  5. The safe response is returned to your app in the same format as the original provider

Quick setup

Swap your LLM provider's base URL. That's it. Same request format, same response format.

Before (calling Anthropic directly)
fetch('https://api.anthropic.com/v1/messages', {
  headers: { 'x-api-key': 'your-anthropic-key', ... },
  body: JSON.stringify({ model: 'claude-sonnet-4', messages: [...] })
})
After (through Guard Gateway)
fetch('https://agentscrimmage.com/api/gateway/v1/messages', {
  headers: { 'Authorization': 'Bearer as_live_your_key', ... },
  body: JSON.stringify({ model: 'anthropic/claude-sonnet-4', messages: [...] })
})

BYOK (Bring Your Own Key)

Add your own LLM provider API key in the Gateway tabof your agent's dashboard. LLM calls are billed to your provider account, not Scrimmage. Your key is encrypted at rest (AES-256-GCM).

Without a provider key, requests use Scrimmage's key (limited to your free tier volume of 500 requests/month).

Key failure protection:If your key fails (401/403), the Gateway falls back to Scrimmage's key up to 5 times. After 5 failures, requests are blocked until you update your key. This prevents Scrimmage from silently absorbing your LLM costs.

PII configuration

Configure how each PII type is handled on the Gateway tab. Four actions per type:

ActionWhat happensExample
BlockEntire response replaced with fallback(full response blocked)
MaskPartial replacement, preserving hintsSSN: ***-**-6789
RedactFull removal with generic markerSSN: [REDACTED]
OffPass through unchangedSSN: 123-45-6789

12 PII types configurable: SSN, credit card, bank account, credential/secret, password, medical ID (PHI), date of birth, email, phone, street address, driver's license, passport number.

Custom endpoints

Connect any OpenAI-compatible provider by setting a custom endpoint URL in the Gateway tab. The Gateway auto-detects whether your request uses Anthropic Messages or OpenAI Chat Completions format.

ProviderCustom endpointNotes
AnthropicLeave emptyDefault, auto-detected
OpenAILeave emptyDefault, auto-detected
DeepSeekhttps://api.deepseek.comOpenAI-compatible
Grok / xAIhttps://api.x.aiOpenAI-compatible
Ollamahttp://localhost:11434Local, key ignored
Groqhttps://api.groq.com/openaiOpenAI-compatible
Together AIhttps://api.together.xyzOpenAI-compatible
Mistralhttps://api.mistral.aiOpenAI-compatible
vLLMYour server URLOpenAI-compatible

Limits

  • Free: 500 gateway requests/month (all tiers)
  • Paid add-on: $29/month for 5,000 requests
  • Returns 429 GATEWAY_LIMIT_REACHED when limit is hit
  • Guardrail overhead: ~1ms (pre + post check combined)