BonkLM is a deterministic guardrail that runs inside your own process, on the surfaces attacks actually arrive on: the retrieved document, the tool result, the memory write, the composed context. No model in the hot path, so every block it makes can be explained to whoever asks.
Your agent reads a document it did not write. The document contains a line addressed to the agent rather than the reader. The agent follows it, because from the inside a retrieved paragraph and a user message look like the same tokens.
That is where the attacks of the last two years actually land: in the RAG hit, the tool result, the memory the agent wrote yesterday and trusts today. A filter pointed at your users’ chat box never sees any of it, and pointing a strict filter at your users instead just blocks paying customers.
BonkLM resolves which surface a piece of content came from, then applies the strict rules only at the connector boundary where untrusted content enters.
Every block names the layer that fired, the risk level, the score and the reason. Paste your own prompt into the playground and watch each layer decide.
A RAG hit is untrusted content wearing your own corpus as a costume. The retrieved-doc validator treats it that way, dropping or blocking instructions aimed at the model rather than the reader.
BoundaryInstructions addressed to a human inside a poisoned chunk are a semantic problem, and are named openly as a limitation rather than claimed as covered.
packages/core/src/validators/retrieved-doc.ts
Arguments an LLM emits get walked before they reach the tool, so a crafted path or command does not execute on the model’s say-so.
BoundaryArguments are scanned at emit time. A reference that resolves to its payload later defeats the scan, which is why custom connectors should pass concrete values.
packages/core/src/validators/tool-call-args.ts
Poisoning what an agent remembers is a durable attack: it fires on every future recall. The memory-write validator gates the write, so today’s injection does not become next month’s context.
BoundaryRedaction sentinels persist into the vector store, so the replacement string is security-relevant config and must never be built from runtime input.
packages/core/src/validators/memory-write.ts
The final assembled prompt is scanned forward and reverse, catching payloads split across entries that each look harmless alone.
BoundaryA payload split across three or more entries, in a permutation neither ordering covers, can evade both; size caps limit how far that scales, and the upstream memory-write gate is the defence in depth.
packages/core/src/validators/composed-context.ts
The full engine, two validators and a guard, clears a short prompt at a mean of roughly 0.06 ms in-process on a single core. Same input, same verdict, every time, with no network hop and no per-request bill.
BoundarySingle-machine numbers on Apple Silicon, deterministic validators only, measured against v1.0.0-rc.4. Validators that call a model inherit that model’s latency separately.
packages/core/benchmarks/RESULTS.md
BonkLM is the Node-native pick for fast, predictable, composable guardrails wired into a specific connector. Run it for the short-circuit and keep an ML service for what patterns do not catch.
BoundaryIt is a pattern engine, so multilingual reach is regex breadth across 12 languages, not depth. ML moderation services have higher recall on non-English, and we say so in our own comparison table.
docs/user/known-limitations.md §4
31 connector packages span frameworks, LLM providers, agent frameworks, RAG and vector stores, memory, and bridges.
npm currently serves 0.2.0 · install from source for the 1.0 line
import {
GuardrailEngine,
PromptInjectionValidator,
JailbreakValidator,
SecretGuard,
} from '@blackunicorn/bonklm'
const engine = new GuardrailEngine({
validators: [
new PromptInjectionValidator({ sensitivity: 'strict' }),
new JailbreakValidator(),
],
guards: [new SecretGuard()],
shortCircuit: true, // stop at the first detection
})
const result = await engine.validate(userMessage)
if (!result.allowed) {
console.log(`Blocked: ${result.reason} (${result.risk_level} risk)`)
}app.post('/chat', async (req, res) => {
const result = await guardrail.validate(req.body.message)
if (!result.allowed) {
return res.status(400).json({ error: result.reason })
}
res.json({ response: await callLLM(req.body.message) })
})Validators are instances, not name strings. The engine refuses to construct with an empty validator list, because an engine with no validators silently allows every input; you have to pass allowEmptyForTesting to opt out, and it logs a critical warning when you do.
A guardrail that claims to catch everything is telling you it has not looked. Here are the ones that change how you should deploy it.
Computer-use agents are an unvalidatable surface.
Screenshots and mouse coordinates carry too little signal for injection detection. Do not use BonkLM as the sole guardrail for a computer-use deployment.
Multilingual coverage is regex breadth, not depth.
12 languages ship with pattern coverage. Idiomatic rewrites pass. Layer a language-specific ML moderation endpoint for non-English traffic.
Streaming cannot prevent a partial leak by default.
Characters released before a late secret appears have already reached the client. Full-response mode is the only setting that prevents it, and it engages automatically when the chain includes secret or PII checks.
Code and path validators are a first line, not containment.
Sandbox isolation is the true containment boundary. Known regex gaps include string-concatenation bypass and variable-driven sinks.
Voice-transcript webhooks detect after the fact.
By the time a transcript webhook fires, the response has been spoken. Put BonkLM in the request path that composes the prompt going in.
Published in full: docs/user/known-limitations.md
No price is published. The enterprise tier is quoted per deployment; email info@blackunicorn.tech and we will scope it with you.
npm serves 0.2.0 today. The 1.0 line, including the four connector-boundary validators, is in the repository as a release candidate and the packaged release follows. We would rather tell you that than let you find out after npm install.
The core library is Apache-2.0 and stays free. Curated rule content and signed threat feeds are BSL-1.1: source-available, free for evaluation and development, commercial for production until each version converts to Apache-2.0 three years after publication. One surface is still stale and we would rather name it than have you find it: the published npm package, 0.2.0, predates the relicence and still declares MIT. The 1.0 release corrects it.
The full engine clears a short prompt at a mean of roughly 0.06 ms in-process on a single core, measured on a single machine against the 1.0 release candidate. There is no network round-trip, because there is no model in the hot path.
No, and we would not recommend it. Run BonkLM in-process for the deterministic short-circuit and keep an ML service for what patterns do not catch. Our own comparison table says where competitors have the better recall.
The core costs nothing under Apache-2.0. The enterprise content tier has no published price and is quoted per deployment.
We reply inside 48 hours, scoped within a week, NDA-first.