Download the PHP package flarex/flareshield without Composer

FlareShield

Laravel-native AI security framework for the LLM era. Defend chatbots, agents, RAG pipelines and tool-calling workflows against prompt injection, jailbreaks, system prompt leakage, RAG poisoning, malicious tool usage and unsafe AI output — with a single Composer install.

Table of Contents

• Why FlareShield
• Threat Model
• Installation
• Quick Start
• Middleware
• Guarding RAG Documents
• Guarding Tool Calls
• Output Validation
• Per-Agent Configuration
• Security Levels
• Events
• Extending FlareShield
• Testing
• Architecture
• License

Why FlareShield

LLM-powered features ship in days, but the threat surface of an AI system is fundamentally different from a traditional web app. FlareShield gives Laravel developers a defense-in-depth toolkit designed specifically for that gap:

• Layered detection — heuristic, encoded-payload, HTML/Markdown, hidden-instruction, multilingual and indirect-injection scanners.
• Risk-scored verdicts — every prompt receives a normalized 0–100 score with three verdicts: pass, flag, block.
• Laravel-native — Service Provider, Facade, middleware aliases, config publishing, events, container-driven extensibility.
• Production-ready — strict types, immutable value objects, PSR-3 logging, no third-party AI dependencies, fully testable.
• Pluggable — every scanner, validator, risk engine and tool policy is bound through the container and trivially overridable.

Threat Model

FlareShield is designed to mitigate the OWASP LLM Top 10 categories most relevant to application-layer code:

FlareShield does not ship any AI model itself. It is a deterministic, auditable, framework-side guardrail — pair it with provider-side moderation (OpenAI Moderation, Llama Guard, AWS Bedrock Guardrails, etc.) for the strongest posture.

Installation

Publish the config (optional but recommended):

The package auto-registers via Laravel's package discovery (FlareShieldServiceProvider) and exposes the FlareShield facade.

Requirements: PHP 8.2+, Laravel 11 / 12 / 13.

Quick Start

Need the structured result instead of an exception? Use scanPrompt / scanOutput:

Middleware

Two middleware aliases are registered:

Parameters: {field}, {agent?}. Blocked prompts return 422 with a structured JSON body. The full ScanResult is also stashed on the request under flareshield.prompt_result so your controller can inspect it.

Guarding RAG Documents

Indirect prompt injection is the #1 RAG threat. Sanitize every retrieved chunk before injecting it into the model context:

guardDocument() will:

1. Run all configured scanners against the chunk.
2. Strip HTML comments, zero-width / control characters and tag-style hidden text.
3. Quote suspicious imperative phrases so the model treats them as data.
4. Truncate to a configured maximum length.
5. Wrap the result in clearly labeled <<<UNTRUSTED_DOCUMENT>>> fences.
6. Throw RagInjectionException when the chunk crosses the block threshold.

Guarding Tool Calls

Configure in config/flareshield.php under the tools key.

Output Validation

scanOutput() runs the configured output_validators. The default OutputValidator flags:

• system-prompt echoes ("system prompt:", "initial instructions:")
• API keys / tokens (AWS, GitHub, OpenAI, JWTs, PEM private keys)
• Markdown image links that look like exfiltration beacons
• raw <script> / on*= HTML

Per-Agent Configuration

Every config key can be overridden per agent:

Security Levels

Tune precisely in config('flareshield.thresholds').

Events

Available events: PromptScanned, OutputScanned, ThreatDetected, ToolCallBlocked.

Extending FlareShield

Write a custom scanner:

Then register it in config/flareshield.php:

Need a different scoring strategy? Bind your own RiskEngine:

Testing

The suite uses Orchestra Testbench and exercises scanners, the risk engine, the manager and the HTTP middleware end-to-end with realistic attack payloads.

Architecture

See docs/threat-model.md for deeper dives.

License

MIT © FlareX. See LICENSE.