Runs mend-guardrails-server on loopback and points Codex/OpenAI-compatible agents at it via OPENAI_BASE_URL so prompt bodies are inspected (secrets, PII, prompt injection) before they reach the model. Also exposes /v1/guard/* and mend-guard-text for scanning MCP and tool-result text.
| Name | Required | Default | Description |
|---|---|---|---|
interceptTui | Optional | false | Opt in to route Codex TUI model calls through loopback Guardrails (user-level model_provider=mend_guardrails). Default false keeps ChatGPT subscription TUI auth. When true, requires a host OpenAI platform API key with api.responses.write (and billing), plus an API model name (not Sol/Luna-only ChatGPT catalog). Options: false, true |
offline | Optional | false | Set MEND_GUARDRAILS_OFFLINE. Default false (online: platform registration and telemetry). Use true with policySource=local so the SDK can load the kit sandbox.json. MEND_KEY is still required. Do not combine with policySource=api. Options: false, true |
policySource | Optional | api | Default api loads the org policy from the Mend Platform (use with offline=false). Enable detectors in the platform policy as needed. Opt in to local for the kit sandbox.json file (startup then sets offline=true). Options: local, api |
pythonSrc | Optional | | Absolute path to a local mend-guardrails-python checkout for editable install instead of the Mend downloads wheel. Empty (default) installs from PyPI + downloads.mend.io. Mount the same path as an extra sbx workspace (not :ro) so install can write egg-info, e.g. sbx run ... --kit-arg mend-guardrails.pythonSrc="$SRC" . "$SRC". |
*.mend.io
mend.io
pypi.org
files.pythonhosted.org
github.com
objects.githubusercontent.com
release-assets.githubusercontent.com
sbx run <agent> --kit sbx/mend-guardrails-kit:latestRun the following command to install sbx on your machine.
brew install docker/tap/sbxwinget install Docker.sbxA Docker Sandboxes mixin kit that runs Mend AI Runtime Protection so OpenAI-compatible traffic is inspected for secrets, PII, and prompt injection before it reaches the model.
Works with Codex by default (requires.agent: codex).
OpenAI-compatible clients in the sandbox use OPENAI_BASE_URL so traffic hits
mend-guardrails-server on loopback first. Allowed requests continue through
the sbx proxy to the model provider; your model API key stays on the host.
Online mode loads org policy from the Mend Platform with MEND_KEY and reports
to the AI Runtime dashboard. Use mend-guard-text when you want the same
policy on MCP or tool-result text.
sbx)MEND_KEY) from
Integrations → Mend AI GuardrailsMEND_KEY is not the Mend CLI Service User key (MEND_USER_KEY). Pass it
with sbx run -e. Do not put secrets in --kit-arg.
sbx run codex --kit ./mend-guardrails -e MEND_KEY="<activation-key>" .
First run can take several minutes while packages and models download.
Default mode is online (policySource=api): the kit loads your org policy
from the Mend Platform and reports to the AI Runtime dashboard. Enable the
detectors you need (for example Prompt Injection and Secret Keys) and set them
to Block before you expect blocks.
| Kit arg | Default | Description |
|---|---|---|
policySource | api | api = platform policy; local = kit bundled policy |
offline | false | Use true only with policySource=local |
interceptTui | false | Also inspect Codex TUI model calls |
pythonSrc | (empty) | Optional path to a local package checkout |
Local policy example:
sbx run codex --kit ./mend-guardrails \
--kit-arg mend-guardrails.policySource=local \
--kit-arg mend-guardrails.offline=true \
-e MEND_KEY="<activation-key>" .
OPENAI_BASE_URL (Chat Completions and similar)
are inspected automatically.interceptTui=true.mend-guard-text (see below).A Guardrails block returns HTTP 400 with
detail.error=guardrail_enforcement_triggered. Other statuses are not policy
verdicts (for example 401 = credentials, 429 = rate or billing).
Your model provider API key stays with Docker Sandboxes; Mend does not store it.
sbx run codex --kit ./mend-guardrails \
--kit-arg mend-guardrails.interceptTui=true \
-e MEND_KEY="<activation-key>" .
When enabled you need:
gpt-4o-mini (ChatGPT catalog-only models will not work
on this path)With the kit running, from a shell in the sandbox (Codex TUI: prefix !):
! mend-guardrails-selftest
Expect PASS for all cases when policy Block is configured for the relevant
detectors. Override the model with OPENAI_MODEL if needed.
Scan untrusted MCP or tool text against the same policy:
mend-guard-text input <<'EOF'
<tool or MCP result text>
EOF
Exit 0 = allowed; exit 2 = blocked. Use mend-guard-text output for
the output-stage policy on candidate replies.
MEND_KEY is for Guardrails only. The Mend CLI authenticates separately
(mend auth login inside the VM, or MEND_EMAIL + MEND_USER_KEY):
sbx run codex \
--kit ./mend-ai-security \
--kit ./mend-guardrails \
-e MEND_KEY="<guardrails-activation-key>" \
.
Both products authenticated at launch:
sbx run codex \
--kit ./mend-ai-security \
--kit ./mend-guardrails \
-e MEND_KEY="<guardrails-activation-key>" \
-e MEND_URL="https://saas.mend.io" \
-e MEND_EMAIL="<service-user-email>" \
-e MEND_USER_KEY="<service-user-key>" \
-e MEND_ORGANIZATION="<org-uuid>" \
.
--kit ./mend-guardrails/git+https://github.com/docker/sbx-kits-contrib.git#ref=<40-hex-sha>&dir=mend-guardrailsdocker.io/sbx/mend-guardrails-kit (pin by digest, not :latest)Apache-2.0 for this kit. Mend Guardrails is a Mend.io product.