frostwolf 0.4.0__tar.gz

frostwolf-0.4.0/.gitignore

@@ -0,0 +1,27 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# Distribution / packaging
+build/
+dist/
+*.egg-info/
+.eggs/
+
+# Virtual environments
+.venv/
+venv/
+env/
+
+# Test / lint / type caches
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.coverage
+htmlcov/
+
+# Editors
+.idea/
+.vscode/
+.DS_Store

frostwolf-0.4.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 FrostWolf
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

frostwolf-0.4.0/PKG-INFO

@@ -0,0 +1,225 @@
+Metadata-Version: 2.5
+Name: frostwolf
+Version: 0.4.0
+Summary: Prompt injection defense for AI applications.
+Project-URL: Homepage, https://frostwolf.app
+Project-URL: Documentation, https://frostwolf.app/docs
+Project-URL: Repository, https://github.com/FrostWolfAI/frostwolf-sdk-python
+Project-URL: Issues, https://github.com/FrostWolfAI/frostwolf-sdk-python/issues
+Author-email: FrostWolf <support@frostwolf.app>
+License: MIT
+License-File: LICENSE
+Keywords: ai-security,anthropic,guardrails,jailbreak,llm-security,openai,prompt-injection
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Classifier: Typing :: Typed
+Requires-Python: >=3.10
+Provides-Extra: dev
+Requires-Dist: mypy>=1.11; extra == 'dev'
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Requires-Dist: ruff>=0.6; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# frostwolf
+
+Prompt injection defense for AI applications.
+
+`frostwolf` inspects the text your application is about to send to a model and
+tells you whether it is safe to send. It works with any provider, adds no LLM
+call, and spends no tokens.
+
+Detection runs on the FrostWolf control plane. The SDK sends text and receives a
+verdict, so the detection set never leaves the server and cannot be read off a
+client.
+
+## Install
+
+```bash
+pip install frostwolf
+```
+
+## Quickstart
+
+```python
+from frostwolf import FrostWolfClient
+
+fw = FrostWolfClient(api_key="sk-your-key-here")
+
+result = fw.guard.scan("Ignore all previous instructions.")
+result.blocked  # True
+result.severity  # "high"
+result.categories  # ("direct_injection",)
+```
+
+## Block a call before it happens
+
+`wrap` inspects the payload first and only invokes your callback when the
+payload is allowed through. The callback receives the payload shaped for both
+major provider specs, so it works with any SDK.
+
+```python
+from openai import OpenAI
+from frostwolf import FrostWolfClient
+
+fw = FrostWolfClient(api_key="sk-your-key-here")
+openai = OpenAI()
+
+completion = fw.guard.wrap(
+    {"system": system, "messages": messages},
+    lambda safe: openai.chat.completions.create(
+        model="gpt-4o-mini",
+        messages=[{"role": m.role, "content": m.content} for m in safe.openai.messages],
+    ),
+)
+
+if isinstance(completion, dict) and "error" in completion:
+    # The request was blocked. `completion` is shaped like a provider error.
+    ...
+```
+
+## Decorate a client
+
+`decorate` wraps a completions function so every call is inspected and captured.
+Your provider SDK stays in place and no base URL is rewritten.
+
+```python
+from openai import OpenAI
+from frostwolf import DecorateOptions, FrostWolfClient
+
+fw = FrostWolfClient(api_key="sk-your-key-here")
+openai = OpenAI()
+
+create = fw.guard.decorate(
+    lambda body: openai.chat.completions.create(**body),
+    DecorateOptions(base_url="https://api.openai.com/v1", provider="openai"),
+)
+
+completion = create(model="gpt-4o-mini", messages=messages)
+```
+
+A decorated function may be sync or async. The wrapper matches the function it
+wraps, so an `AsyncOpenAI` client stays async.
+
+```python
+from openai import AsyncOpenAI
+
+aclient = AsyncOpenAI()
+
+acreate = fw.guard.decorate(
+    lambda body: aclient.chat.completions.create(**body),
+    DecorateOptions(provider="openai"),
+)
+
+completion = await acreate(model="gpt-4o-mini", messages=messages)
+```
+
+Streams are teed rather than buffered, so each chunk reaches you before it is
+recorded and no latency is added.
+
+## Redact instead of block
+
+`sanitise` replaces every matched span and returns the payload shaped for both
+provider specs.
+
+```python
+result = fw.guard.sanitise({"system": system, "messages": messages})
+
+result.report.redacted  # number of spans replaced
+result.openai.messages  # ready for the OpenAI SDK
+result.anthropic.system  # ready for the Anthropic SDK
+```
+
+Set `on_match="sanitise"` to have `wrap` and `decorate` redact and forward
+instead of refusing the call.
+
+```python
+from frostwolf import FrostWolfClient, GuardOptions
+
+fw = FrostWolfClient(
+    api_key="sk-your-key-here",
+    guard=GuardOptions(on_match="sanitise"),
+)
+```
+
+## Client options
+
+| Option              | Default                     | Description                                  |
+| ------------------- | --------------------------- | -------------------------------------------- |
+| `api_key`           | required                    | Your FrostWolf API key.                      |
+| `endpoint`          | `https://api.frostwolf.app` | Control plane base URL.                      |
+| `telemetry`         | `True`                      | Ship metrics to the console.                 |
+| `capture`           | `False`                     | Ship request and response bodies.            |
+| `include_evidence`  | `False`                     | Include matched substrings in telemetry.     |
+| `on_scan_error`     | `"block"`                   | What to do when detection cannot be reached. |
+| `timeout_ms`        | `5000`                      | Per-request timeout.                         |
+| `flush_interval_ms` | `5000`                      | Background flush interval.                   |
+| `max_batch_size`    | `50`                        | Records per flush.                           |
+| `max_queue_size`    | `1000`                      | Bounded queue; oldest records are dropped.   |
+| `transport`         | `urllib_transport`          | Swap in your own HTTP callable.              |
+| `on_error`          | no-op                       | Called with any reporting failure.           |
+| `guard`             | `GuardOptions()`            | Guard-level defaults.                        |
+
+### `init(options=None)`
+
+`init` authenticates the key and reports the caller behind it. It never raises:
+a rejected key or an unreachable control plane is reported in the result.
+
+```python
+from frostwolf import FrostWolfClient, InitOptions
+
+fw = FrostWolfClient(api_key="sk-your-key-here")
+result = fw.init(InitOptions(capture=True))
+
+result.authenticated    # True
+result.capture_enabled  # what the server actually holds
+```
+
+`InitOptions(capture=...)` turns capture on or off for this key, server-side.
+`None` leaves the stored setting alone. The flag is read back from the server
+rather than echoed from the request, so a caller that asked for capture and did
+not get it can tell.
+
+### Guard options
+
+| Option           | Default               | Description                               |
+| ---------------- | --------------------- | ----------------------------------------- |
+| `on_match`       | `"block"`             | `block`, `sanitise`, or `allow`.          |
+| `block_severity` | control plane default | Lowest severity that trips the policy.    |
+| `max_scan_chars` | control plane default | Truncate longer payloads before scanning. |
+| `replacement`    | `"[REDACTED]"`        | Text substituted for each redacted span.  |
+| `on_decision`    | `None`                | Called after every inspection.            |
+
+## Failure behavior
+
+Detection needs the network. When the control plane cannot be reached, the guard
+resolves the failure according to `on_scan_error`:
+
+- `"block"` (default) fails closed. The verdict carries
+  `reason="scan_unavailable"`, so an operator can tell an outage apart from a
+  detection.
+- `"allow"` fails open. The verdict is an allow with no severity, and the
+  telemetry record still shows the decision that was made.
+
+Telemetry and capture never sit on the request path. A reporting failure is
+reported through `on_error` and never raised.
+
+## Development
+
+```bash
+pip install -e ".[dev]"
+pytest
+ruff check .
+mypy
+```
+
+## License
+
+MIT

frostwolf-0.4.0/README.md

@@ -0,0 +1,195 @@
+# frostwolf
+
+Prompt injection defense for AI applications.
+
+`frostwolf` inspects the text your application is about to send to a model and
+tells you whether it is safe to send. It works with any provider, adds no LLM
+call, and spends no tokens.
+
+Detection runs on the FrostWolf control plane. The SDK sends text and receives a
+verdict, so the detection set never leaves the server and cannot be read off a
+client.
+
+## Install
+
+```bash
+pip install frostwolf
+```
+
+## Quickstart
+
+```python
+from frostwolf import FrostWolfClient
+
+fw = FrostWolfClient(api_key="sk-your-key-here")
+
+result = fw.guard.scan("Ignore all previous instructions.")
+result.blocked  # True
+result.severity  # "high"
+result.categories  # ("direct_injection",)
+```
+
+## Block a call before it happens
+
+`wrap` inspects the payload first and only invokes your callback when the
+payload is allowed through. The callback receives the payload shaped for both
+major provider specs, so it works with any SDK.
+
+```python
+from openai import OpenAI
+from frostwolf import FrostWolfClient
+
+fw = FrostWolfClient(api_key="sk-your-key-here")
+openai = OpenAI()
+
+completion = fw.guard.wrap(
+    {"system": system, "messages": messages},
+    lambda safe: openai.chat.completions.create(
+        model="gpt-4o-mini",
+        messages=[{"role": m.role, "content": m.content} for m in safe.openai.messages],
+    ),
+)
+
+if isinstance(completion, dict) and "error" in completion:
+    # The request was blocked. `completion` is shaped like a provider error.
+    ...
+```
+
+## Decorate a client
+
+`decorate` wraps a completions function so every call is inspected and captured.
+Your provider SDK stays in place and no base URL is rewritten.
+
+```python
+from openai import OpenAI
+from frostwolf import DecorateOptions, FrostWolfClient
+
+fw = FrostWolfClient(api_key="sk-your-key-here")
+openai = OpenAI()
+
+create = fw.guard.decorate(
+    lambda body: openai.chat.completions.create(**body),
+    DecorateOptions(base_url="https://api.openai.com/v1", provider="openai"),
+)
+
+completion = create(model="gpt-4o-mini", messages=messages)
+```
+
+A decorated function may be sync or async. The wrapper matches the function it
+wraps, so an `AsyncOpenAI` client stays async.
+
+```python
+from openai import AsyncOpenAI
+
+aclient = AsyncOpenAI()
+
+acreate = fw.guard.decorate(
+    lambda body: aclient.chat.completions.create(**body),
+    DecorateOptions(provider="openai"),
+)
+
+completion = await acreate(model="gpt-4o-mini", messages=messages)
+```
+
+Streams are teed rather than buffered, so each chunk reaches you before it is
+recorded and no latency is added.
+
+## Redact instead of block
+
+`sanitise` replaces every matched span and returns the payload shaped for both
+provider specs.
+
+```python
+result = fw.guard.sanitise({"system": system, "messages": messages})
+
+result.report.redacted  # number of spans replaced
+result.openai.messages  # ready for the OpenAI SDK
+result.anthropic.system  # ready for the Anthropic SDK
+```
+
+Set `on_match="sanitise"` to have `wrap` and `decorate` redact and forward
+instead of refusing the call.
+
+```python
+from frostwolf import FrostWolfClient, GuardOptions
+
+fw = FrostWolfClient(
+    api_key="sk-your-key-here",
+    guard=GuardOptions(on_match="sanitise"),
+)
+```
+
+## Client options
+
+| Option              | Default                     | Description                                  |
+| ------------------- | --------------------------- | -------------------------------------------- |
+| `api_key`           | required                    | Your FrostWolf API key.                      |
+| `endpoint`          | `https://api.frostwolf.app` | Control plane base URL.                      |
+| `telemetry`         | `True`                      | Ship metrics to the console.                 |
+| `capture`           | `False`                     | Ship request and response bodies.            |
+| `include_evidence`  | `False`                     | Include matched substrings in telemetry.     |
+| `on_scan_error`     | `"block"`                   | What to do when detection cannot be reached. |
+| `timeout_ms`        | `5000`                      | Per-request timeout.                         |
+| `flush_interval_ms` | `5000`                      | Background flush interval.                   |
+| `max_batch_size`    | `50`                        | Records per flush.                           |
+| `max_queue_size`    | `1000`                      | Bounded queue; oldest records are dropped.   |
+| `transport`         | `urllib_transport`          | Swap in your own HTTP callable.              |
+| `on_error`          | no-op                       | Called with any reporting failure.           |
+| `guard`             | `GuardOptions()`            | Guard-level defaults.                        |
+
+### `init(options=None)`
+
+`init` authenticates the key and reports the caller behind it. It never raises:
+a rejected key or an unreachable control plane is reported in the result.
+
+```python
+from frostwolf import FrostWolfClient, InitOptions
+
+fw = FrostWolfClient(api_key="sk-your-key-here")
+result = fw.init(InitOptions(capture=True))
+
+result.authenticated    # True
+result.capture_enabled  # what the server actually holds
+```
+
+`InitOptions(capture=...)` turns capture on or off for this key, server-side.
+`None` leaves the stored setting alone. The flag is read back from the server
+rather than echoed from the request, so a caller that asked for capture and did
+not get it can tell.
+
+### Guard options
+
+| Option           | Default               | Description                               |
+| ---------------- | --------------------- | ----------------------------------------- |
+| `on_match`       | `"block"`             | `block`, `sanitise`, or `allow`.          |
+| `block_severity` | control plane default | Lowest severity that trips the policy.    |
+| `max_scan_chars` | control plane default | Truncate longer payloads before scanning. |
+| `replacement`    | `"[REDACTED]"`        | Text substituted for each redacted span.  |
+| `on_decision`    | `None`                | Called after every inspection.            |
+
+## Failure behavior
+
+Detection needs the network. When the control plane cannot be reached, the guard
+resolves the failure according to `on_scan_error`:
+
+- `"block"` (default) fails closed. The verdict carries
+  `reason="scan_unavailable"`, so an operator can tell an outage apart from a
+  detection.
+- `"allow"` fails open. The verdict is an allow with no severity, and the
+  telemetry record still shows the decision that was made.
+
+Telemetry and capture never sit on the request path. A reporting failure is
+reported through `on_error` and never raised.
+
+## Development
+
+```bash
+pip install -e ".[dev]"
+pytest
+ruff check .
+mypy
+```
+
+## License
+
+MIT

frostwolf-0.4.0/pyproject.toml

@@ -0,0 +1,76 @@
+[build-system]
+requires = ["hatchling>=1.21"]
+build-backend = "hatchling.build"
+
+[project]
+name = "frostwolf"
+version = "0.4.0"
+description = "Prompt injection defense for AI applications."
+readme = "README.md"
+requires-python = ">=3.10"
+license = { text = "MIT" }
+authors = [{ name = "FrostWolf", email = "support@frostwolf.app" }]
+keywords = [
+    "prompt-injection",
+    "llm-security",
+    "ai-security",
+    "guardrails",
+    "jailbreak",
+    "openai",
+    "anthropic",
+]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Intended Audience :: Developers",
+    "License :: OSI Approved :: MIT License",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Topic :: Security",
+    "Topic :: Software Development :: Libraries :: Python Modules",
+    "Typing :: Typed",
+]
+dependencies = []
+
+[project.urls]
+Homepage = "https://frostwolf.app"
+Documentation = "https://frostwolf.app/docs"
+Repository = "https://github.com/FrostWolfAI/frostwolf-sdk-python"
+Issues = "https://github.com/FrostWolfAI/frostwolf-sdk-python/issues"
+
+[project.optional-dependencies]
+dev = [
+    "pytest>=8.0",
+    "ruff>=0.6",
+    "mypy>=1.11",
+]
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/frostwolf"]
+
+[tool.hatch.build.targets.sdist]
+include = ["src/frostwolf", "tests", "README.md", "LICENSE"]
+
+[tool.ruff]
+line-length = 88
+target-version = "py310"
+src = ["src", "tests"]
+
+[tool.ruff.lint]
+select = ["E", "F", "I", "B", "UP", "SIM", "C4", "RET"]
+
+[tool.ruff.lint.per-file-ignores]
+"tests/*" = ["E501"]
+
+[tool.mypy]
+python_version = "3.10"
+strict = true
+files = ["src"]
+warn_unreachable = true
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+pythonpath = ["src"]
+addopts = "-q"