Bouclier.ai is a prompt-injection firewall that runs on your Mac, between your coding agent and the model provider. It reads the content your agent pulls in from the outside — a fetched web page, a search result, an MCP response — and flags anything trying to reprogram it. It monitors by default; flip on blocking and it refuses those requests outright. Your own prompts, and the files you read from your own project, are never touched. No certificate to install.
Beta — research prototype. Not meant to be used live.
Bouclier is published for evaluation, security research, and personal experimentation. It is not a commercial product, is not supported, and is not meant for production, regulated workloads, or any environment where a failure could cause harm. Detection is best-effort and evadable by a determined attacker — it raises cost, it is not a guarantee. See the Terms before installing.
Local-only. 186 detection patterns and an on-device ML classifier run on your Mac. No cloud scanning, no telemetry, no accounts.
Paste anything, then flip where it came from. Instructions inside tool output get the request refused — nobody in your session typed them, so they have no business giving orders. The identical sentence typed by you is logged and forwarded, because you are the one the agent works for. The regex tier that ships in the Mac app runs right here in your browser; nothing leaves your machine. The app also fuses in an on-device ML classifier and false-positive dampeners the browser can't run, so it catches more than this demo.
Bouclier never edits your prompt. A request is either forwarded byte-for-byte or refused outright with a 422 naming what matched and where — earlier versions rewrote flagged text in place, which broke prompt caching and tripped provider abuse detection, and that behaviour is gone for good.
Every guardrail that scans "the prompt" eventually blocks its own user — the security engineer pasting an advisory, the developer testing a jailbreak. Bouclier splits the request by origin before it scores anything, so the action it takes depends on who said it, not just what was said.
tool_result blocks, role: "tool" messages, function_call_output items, and retrieved content — document / search_result blocks and anything wrapped in the <document> RAG convention, even inside a user turn. Content your agent pulled from outside your workspace — the web, a search, an external tool. Nobody in the session wrote it, so an instruction in there is an attack by definition. By default it's logged and forwarded (monitor mode); turn on blocking and the request is refused with a 422 naming the pattern and the JSON path.
Your prompt and system prompt — you are the principal, allowed to discuss attacks with your own model — and the files your agent reads from your own project: your docs, your CLAUDE.md, your research notes. A file read from a path you control is trusted like your own words: scanned so the activity log stays useful, never blocked. Only content from outside your workspace can be refused — and the fetch-then-read dodge is still caught, because the fetch itself is inspected. Teams that want to police everything can turn on the stricter posture by MDM policy.
Prompt injection is not solved, and a pattern engine is not a solution to it. The defences that actually hold are structural — constraining what a hijacked agent can reach, keeping untrusted input away from privileged actions. Bouclier is defence in depth on the untrusted leg: it raises the cost of the easy attacks and shows you when one arrives. Treat it the way you treat a WAF, not the way you treat a proof.
ANTHROPIC_BASE_URL / OPENAI_BASE_URL. Anything that ignores those env vars (a tool with a hard-coded base URL, an already-running shell, an app with its own backend) talks to the provider directly.We run the shipped pipeline — the 186 patterns, the false-positive dampeners, and the on-device Prompt Guard 2 classifier — against third-party corpora, and publish the harness so you can reproduce it. Each test string is scored as untrusted tool output, exactly as the gateway would.
Across 512 external benign prompts — including NotInject, a set built to trip guardrails with security vocabulary — the shipped build blocked 0.6% (1.8% on NotInject alone). This is the number that matters for staying out of your way, and it's the hard one to game.
On 777 payloads from a public instruction-override corpus (Lakera's gandalf set). This is detection on a static corpus of one attack class — read it as coverage of known families, not a guarantee.
These are static-corpus results. They say nothing about an attacker optimizing against the detector — every detector of this kind, ours included, is bypassed at high rates under adaptive attack. A clean pass is not evidence of safety. The default install runs in monitor mode and blocks nothing until you turn enforcement on. Measured on v0.9.10 (10 Aug 2026); numbers move with each release.
Bouclier ships an MCP server and a bouclier CLI that share one core. An agent can orient itself — is protection on, how much has it inspected — before it acts. What it can't do is the point: the CLI is read-only. There is no agent path to disable protection. The tool can't switch off the thing guarding it.
# orient before acting
bouclier status
→ protection ON (standard mode) · 128 inspected, 0 blocked
# there is no disable command
bouclier --help
→ status · install · --version (read-only, by design)bouclier status returns protection state, mode, and activity counts as JSON. An agent can check it's protected before it runs — no approval needed to read.
Register the injection MCP with Claude Code once (bouclier install prints the command). Same read-only core as the CLI.
Disable protection or uninstall — neither has an agent path, only a human one in the app. The tool can't weaken its own guard.
Bouclier points your AI tools at a local gateway by setting a base URL — no root certificate, nothing installed in your trust store, no system-wide interception. The gateway never rewrites a request: it forwards it byte-for-byte, or refuses it outright. There is no in-between.
Forwarded byte-for-byte. Bouclier has no rewrite path at all — a request is delivered unmodified or refused. No blind redactor touching your fields, nothing spliced into your prompt.
Authorization, x-api-key, trace IDs, analytics — every header reaches the upstream unmodified, so your tools keep working. Pinned by an end-to-end test so a future change can't drift.
The gateway binds 127.0.0.1 and nothing else — there's no system-wide traffic redirection. Only processes that explicitly point at it (ANTHROPIC_BASE_URL / OPENAI_BASE_URL) are ever in scope.
Bouclier installs nothing in your trust store. The byte-identical guarantee — a request is forwarded unchanged or refused, never rewritten — is pinned by an end-to-end test in CI on every release.
Deploy and configure via Jamf, Kandji, or Mosyle. Control the gateway port, additional AI domains, and feature flags — including enforcement mode — across your fleet.
Ship monitor mode to learn your baseline, then flip blocking on by policy when you're ready. A single MDM flag turns the whole fleet from detect-and-log to refuse.
Every inspected request and every refusal is logged locally and can be forwarded to your SIEM. Export a privacy-scrubbed diagnostics bundle for incident response.
An agent can use Bouclier but never weaken it — disabling protection has no agent path, only a human one in the app. The tool can't switch off its own guard.
Detection runs entirely on your Mac — 186 patterns and the on-device ML classifier. Your traffic never leaves the machine to be inspected.
No cloud LLM, no analytics, no telemetry in the app.
Scan logs never contain your prompts, responses, or API keys — only metadata.
Bouclier installs no certificate — the gateway is a plaintext-loopback relay, not a TLS-terminating proxy.
Published threat model and privacy policy covering every trust boundary.
Download the DMG, drag to Applications, click Enable. Every tool result your agent reads is inspected for injection from that moment — on your Mac, nothing installed.
Download for macOSmacOS 15+ · Apple Silicon & Intel · v0.9.10