🏰 IronWarden

High-Performance Sovereign AI Reverse Proxy & Privacy Firewall

IronWarden is a sovereign, ultra-low-latency AI security reverse proxy and PII firewall written in bare-metal Rust.

Point any OpenAI, Anthropic, or Ollama/vLLM SDK client at IronWarden to get real-time streaming PII redaction, sliding-window SSE token rehydration, prompt injection defense, and cryptographic HMAC-SHA256 audit chaining — with zero code changes in your application.

---

⚡ Technical Superiority & Latency Benchmark Matrix

---

🏗️ Architecture

       [ Client / Microservices / OpenAI & Anthropic SDKs ]
                   │
                   ▼ (HTTP/2, Streaming SSE, JSON-RPC)
       ┌─────────────────────────────────────────────────────────────┐
       │                   IronWarden Core Gateway                   │
       │                                                             │
       │  ┌──────────────────┐    ┌────────────────────────────────┐ │
       │  │ Token Bucket     │    │ Axum / Hyper High-Concurrency  │ │
       │  │ GCRA Rate Limit  │───▶│ Non-Blocking Connection Pool   │ │
       │  └──────────────────┘    └────────────────────────────────┘ │
       │                                     │                       │
       │                                     ▼                       │
       │  ┌────────────────────────────────────────────────────────┐ │
       │  │ Streaming SSE Rehydration Engine                       │ │
       │  │  • Sliding-window token reassembly across chunk splits │ │
       │  │  • Zero-copy string normalization & homoglyph defense  │ │
       │  └────────────────────────────────────────────────────────┘ │
       │                                     │                       │
       │                                     ▼                       │
       │  ┌────────────────────────────────────────────────────────┐ │
       │  │ Multi-Tier PII & Security Gating                       │ │
       │  │  • Layer 1: SIMD-Accelerated Aho-Corasick Regex Rules  │ │
       │  │  • Layer 2: ShadowNer Named Entity Recognition         │ │
       │  │  • Layer 3: Prompt Injection & Smuggling Guardrail     │ │
       │  └────────────────────────────────────────────────────────┘ │
       │                                     │                       │
       │                                     ▼                       │
       │  ┌────────────────────────────────────────────────────────┐ │
       │  │ Tamper-Proof Audit Chaining (HMAC-SHA256 Merkle Chain) │ │
       │  │  • Verifiable cryptographic audit trail for EU AI Act  │ │
       │  └────────────────────────────────────────────────────────┘ │
       └───────────────────────────────┬─────────────────────────────┘
                                       │ (Redacted Outbound TX)
                                       ▼
                 [ Upstream LLMs: OpenAI / Anthropic / Local Ollama ]

---

⚡ Zero-Friction Quickstart

1. Run with Docker (1-Command Instant Start)

Spin up IronWarden in 5 seconds with zero configuration:

docker run -d --name ironwarden \
  -p 8080:8080 \
  -e UPSTREAM_LLM="https://api.openai.com" \
  -e WARDEN_MODE="hybrid" \
  ghcr.io/somnerd/ironwarden:latest

2. Verify with Streaming Curl

Send an LLM prompt containing sensitive PII and observe instant streaming token restoration with zero telemetry leakage:

curl -X POST http://localhost:8080/v1/chat/completions \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{
    "model": "gpt-4o",
    "messages": [
      {"role": "user", "content": "Process payment for John Doe, SSN 000-12-3456, IBAN GR1201101250000000012345678."}
    ],
    "stream": true
  }'

3. Deploy with Docker Compose

docker compose up -d

4. Deploy to Kubernetes with Helm

helm install ironwarden ./deploy/helm/ironwarden \
  --set secrets.wardenPepper="0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef" \
  --set secrets.openaiApiKey="sk-..."

5. Build & Run from Source

git clone https://github.com/Somnerd/IronWarden.git
cd IronWarden

# Optional: Download ONNX NER weights (falls back to high-speed heuristic mode if omitted)
./scripts/setup_models.sh

# Run the gateway
export WARDEN_PEPPER=$(openssl rand -hex 16)
cargo run --release -p app

---

🔌 Universal Drop-in SDK Compatibility

OpenAI Python SDK

Simply set base_url to IronWarden's gateway endpoint:

from openai import OpenAI

# Point client to IronWarden — zero code modifications required
client = OpenAI(
    api_key="sk-mock-or-real",
    base_url="http://localhost:14141/v1",
    default_headers={"Authorization": "Bearer <your-jwt-or-key>"}
)

response = client.chat.completions.create(
    model="gpt-4o",
    messages=[
        {"role": "user", "content": "Patient John Doe (SSN: 123-45-6789) shows elevated blood pressure."}
    ],
    stream=True # Streaming supported natively with real-time SSE token rehydration
)

for chunk in response:
    if chunk.choices[0].delta.content:
        print(chunk.choices[0].delta.content, end="", flush=True)

# ✅ PII scrubbed before reaching upstream LLM
# ✅ HMAC-chained tamper-evident audit record logged
# ✅ PII seamlessly restored in the output stream

Anthropic Claude Python SDK

import anthropic

client = anthropic.Anthropic(
    api_key="sk-ant-...",
    base_url="http://localhost:14141",
    default_headers={
        "Authorization": "Bearer <your-jwt-or-key>",
        "X-IronWarden-Upstream-Key": "sk-ant-..."
    }
)

message = client.messages.create(
    model="claude-3-5-sonnet-20241022",
    max_tokens=1024,
    messages=[{"role": "user", "content": "Customer Jane Smith (Email: jane@enterprise.com) requested a refund."}]
)
print(message.content[0].text)

Dynamic Upstream Routing Headers

Automatic Model Routing:

• claude-* ➔ Anthropic API (https://api.anthropic.com/v1/messages)
• llama*, mistral*, phi*, gemma*, qwen* ➔ Local Ollama (http://localhost:11434/v1/chat/completions)
• All other models ➔ OpenAI API (https://api.openai.com/v1/chat/completions)

---

🛡️ Core Capabilities & Invariants

1. Real-Time Streaming SSE Token Rehydration

Unlike standard proxies that buffer the entire response to replace tokens (introducing massive latency and breaking streaming UI), IronWarden implements an asynchronous SSE sliding-window state machine (SseRehydrator). It dynamically stitches split tokens across partial HTTP chunks in under 0.04 ms per chunk.

2. Hybrid Intelligence PII Shield

• Deterministic Layer (Aho-Corasick + Entropy Smuggling Protection): Ultra-fast regex and entropy heuristics for Credit Cards, SSNs, Emails, Phone Numbers, IBANs, and International IDs (including Greek AMKA/AFM and EU identifiers).
• Probabilistic Layer (Local ONNX NER): In-process DistilBERT Named Entity Recognition for contextual Names, Organizations, and Locations.

3. Cryptographic Audit Vault & Strict Fail-Closed Invariants

• AES-256-GCM Encryption: Prompt and redaction records are encrypted at rest using your cryptographic pepper.
• HMAC-SHA256 Hash Chaining: Every log entry is cryptographically linked to the previous record with continuous full-chain integrity walk verification.
• Fail-Closed Security: If storage fills up or audit logging fails, IronWarden physically halts upstream egress to prevent un-audited data leakage.

4. Turnkey Compliance Presets

Pre-configured, zero-touch regulatory rule sets ready to deploy:

• Middle East & GCC Sovereignty (config/rules/me.yaml): Saudi Arabia PDPL (SDAIA), UAE Federal Decree-Law No. 45/2021, Qatar. Emirates ID, Saudi National ID/Iqama, Saudi & UAE IBANs, GCC mobile numbers, Arabic name heuristics.
• East Asia Sovereignty (config/rules/east_asia.yaml): China PIPL / CSL, Japan APPI, South Korea PIPA, Singapore PDPA. China Resident ID, USCC, China Mobile, Japan My Number, Korea RRN, Singapore NRIC.
• India DPDP Act 2023 (config/rules/in.yaml): PAN cards, Aadhaar numbers, GSTIN, Voter ID (EPIC), Indian Passports, Indian Mobile.
• GDPR & European Sovereignty (config/rules/eu.yaml, config/rules/gr.yaml): EU & Greek national IDs (AMKA, AFM), EU IBANs, Passports, Driving Licenses.
• HIPAA (config/rules/rules_medical.yaml): Medical records, Patient IDs, MRNs, SSNs.
• PCI-DSS (config/rules/rules.yaml): Primary Account Numbers (PANs), CVVs, track data.

5. Model Context Protocol (MCP) Server

IronWarden includes a native JSON-RPC 2.0 stdio MCP server for agentic AI architectures (Claude Desktop, Cursor, AI agents) with session isolation and prompt sanitization tools:

• mcp_sanitize_prompt
• mcp_restore_prompt
• mcp_get_compliance_report

---

📊 Performance Benchmarks

Measured using Criterion.rs with 1,000+ iterations per sample. See BENCHMARKS.md for full methodology.

---

📈 Observability & Grafana Dashboard

IronWarden includes native, production-grade observability:

• Prometheus Metrics: GET /metrics exposes request counts, blocked prompt injections, redacted PII entities, and available concurrency permits.
• Turnkey Grafana Dashboard: GET /grafana/dashboard exports the pre-configured Grafana dashboard JSON.
• Structured Health Inspection: GET /health returns JSON uptime, permit availability, and system status.

1-Command Monitoring Stack

Launch IronWarden + Prometheus + Grafana together:

docker compose -f monitoring/docker-compose.monitoring.yml up -d

Visit http://localhost:3000 (admin/admin) to view real-time gateway traffic, blocked prompt injection attacks, and redacted PII statistics.

---

🛠️ Need Custom High-Performance Systems or Sovereign AI Infrastructure?

I partner with engineering teams and startups on fractional consulting and dedicated infrastructure sprints:

• The 1-Week Sovereign AI Gateway Sprint (€4,500 flat fee): VPC deployment, custom PII rules, and <0.1ms streaming latency.
• Custom Rust Reverse Proxies & Protocol Gateways (HTTP/2, Tokio, Axum, L2.5–L7 signaling).
• Backend Performance Audits & Python-to-Rust Migrations.

👉 Contact Nikolas Alexandrakis for Architecture & Consulting Inquiries

---

🤝 Open Source & Community

• Contributing: Please read our CONTRIBUTING.md and CODE_OF_CONDUCT.md.
• Security Disclosures: For vulnerability reporting, please see SECURITY.md.
• Maintainer Notes: See MAINTAINER_NOTES.md.
• License: Licensed under the MIT License. 100% free and open-source software for commercial and private use.
• Enterprise Services & Support: For custom PII rule modeling, compliance readiness, or dedicated architecture sprints, see LICENSE-COMMERCIAL.md.
• Copyright: Copyright (c) 2026 IronWarden Maintainers.