Skip to content

Landscape

The gateways route.
The guardrails inspect.
Neither counts.

Tools that sit between a coding agent and a model, surveyed 2026-10-19. A tool optimised for a different job is not being criticised — and three of them are better than this project at something named below.

Three clusters, and an empty corner

A positioning map produced by principal component analysis. The horizontal axis runs from Resourceful on the left to Vigilant on the right; the vertical from Secure at the bottom to Disciplined at the top. LiteLLM, Kong AI Gateway, Portkey, Bifrost, NeMo Guardrails, Guardrails AI and LLM Guard cluster on the left and centre. ToolHive and the Docker Model Context Protocol (MCP) Gateway sit at the lower right, with agent-scan, Open Policy Agent and client-side harness config near the centre right. ai-bunker sits alone in the top right.
Read it as a shape, not a scoreboard. Produced by standpoint from the ratings table, by PCA.

Left — the gateways

LiteLLM, Kong, Portkey. One OpenAI-shaped surface over a hundred providers, with keys, budgets, retries and observability — done very well. What they do not do is look at what the agent is reading or about to run: a tool result full of secrets and a rm -rf ~ pass through as ordinary bytes.

Right and below — the rule engines

NeMo Guardrails, Guardrails AI, LLM Guard. They inspect content properly, and several do it better than this project. What they are not is a gateway: they are libraries you call, so an agent that does not call them is unprotected, and swapping harness loses them entirely.

Top right — empty except this

Nobody else combines the gateway's position — every request, every client, no opt-out — with the rule engine's inspection and a budget the server counts. That is a claim about coverage, not about quality.

Where this project is behind

Worth stating, since a landscape where one tool wins every column is a landscape nobody believes.

Provider breadth — LiteLLM, by a wide margin
A hundred providers against whatever you configure here. If the question is "call many providers through one client", LiteLLM is simply the answer — and ai-bunker can sit in front of it rather than compete.
Content classifiers — LLM Guard and Guardrails AI
Their scanners are trained models and curated validator hubs; this ships versioned regular expressions with an entropy gate. Reviewable, diffable and free to run — a deliberate trade, and on raw detection quality it is a trade, not a win.
Policy expressiveness and testing — OPA
Rego expresses conditions a regex cannot, and OPA's test tooling with coverage is better than rules --check. The idea of policy carrying its own tests was taken from there.
Maturity
This is 0.2.0-alpha next to projects with years of production use.

Ideas taken from the field

None of this was invented here, and saying so costs nothing.

  • Open Policy Agent

    Policy carries its own tests, and decisions are logged from day one. Both are now load-bearing here — and the first caught three wrong patterns before they reached a deployment.

  • gitleaks

    Regex and an entropy gate, plus per-rule allowlists. A scanner that cries wolf teaches its readers to ignore it.

  • Microsoft's spotlighting

    Mark retrieved content as data. Pattern matching catches clumsy injection attempts; the structural marking is what holds when the patterns miss.

  • Agent-harness research

    The "prevention versus cure" split: bound context structurally, or let it grow and compress. This project is prevention, moved server-side — which the taxonomy does not have a box for.

The full table, with a write-up per tool →