Guard Gateway
Route LLM calls through Scrimmage to block, mask, or redact PII and unsafe content in real time — before responses reach your users.
How it works
- Your app sends the LLM request to Scrimmage instead of directly to the provider
- Pre-guardrail: Tier 1 scans the user input for CRITICAL issues. If found, the request is blocked immediately — no LLM call is made.
- Scrimmage forwards the request to the LLM provider (using your API key or Scrimmage's)
- Post-guardrail: Tier 1 scans the LLM response. Depending on your PII config, it blocks, masks, or redacts flagged content.
- The safe response is returned to your app in the same format as the original provider
Quick setup
Swap your LLM provider's base URL. That's it. Same request format, same response format.
fetch('https://api.anthropic.com/v1/messages', {
headers: { 'x-api-key': 'your-anthropic-key', ... },
body: JSON.stringify({ model: 'claude-sonnet-4', messages: [...] })
})fetch('https://agentscrimmage.com/api/gateway/v1/messages', {
headers: { 'Authorization': 'Bearer as_live_your_key', ... },
body: JSON.stringify({ model: 'anthropic/claude-sonnet-4', messages: [...] })
})BYOK (Bring Your Own Key)
Add your own LLM provider API key in the Gateway tabof your agent's dashboard. LLM calls are billed to your provider account, not Scrimmage. Your key is encrypted at rest (AES-256-GCM).
Without a provider key, requests use Scrimmage's key (limited to your free tier volume of 500 requests/month).
Key failure protection:If your key fails (401/403), the Gateway falls back to Scrimmage's key up to 5 times. After 5 failures, requests are blocked until you update your key. This prevents Scrimmage from silently absorbing your LLM costs.
PII configuration
Configure how each PII type is handled on the Gateway tab. Four actions per type:
| Action | What happens | Example |
|---|---|---|
| Block | Entire response replaced with fallback | (full response blocked) |
| Mask | Partial replacement, preserving hints | SSN: ***-**-6789 |
| Redact | Full removal with generic marker | SSN: [REDACTED] |
| Off | Pass through unchanged | SSN: 123-45-6789 |
12 PII types configurable: SSN, credit card, bank account, credential/secret, password, medical ID (PHI), date of birth, email, phone, street address, driver's license, passport number.
Custom endpoints
Connect any OpenAI-compatible provider by setting a custom endpoint URL in the Gateway tab. The Gateway auto-detects whether your request uses Anthropic Messages or OpenAI Chat Completions format.
| Provider | Custom endpoint | Notes |
|---|---|---|
| Anthropic | Leave empty | Default, auto-detected |
| OpenAI | Leave empty | Default, auto-detected |
| DeepSeek | https://api.deepseek.com | OpenAI-compatible |
| Grok / xAI | https://api.x.ai | OpenAI-compatible |
| Ollama | http://localhost:11434 | Local, key ignored |
| Groq | https://api.groq.com/openai | OpenAI-compatible |
| Together AI | https://api.together.xyz | OpenAI-compatible |
| Mistral | https://api.mistral.ai | OpenAI-compatible |
| vLLM | Your server URL | OpenAI-compatible |
Limits
- Free: 500 gateway requests/month (all tiers)
- Paid add-on: $29/month for 5,000 requests
- Returns
429 GATEWAY_LIMIT_REACHEDwhen limit is hit - Guardrail overhead: ~1ms (pre + post check combined)