Tripwire

## What it does Tripwire is a wrapper that watches an LLM's tokens as they stream and aborts the moment a rule trips. The point is to catch banned content while it's still arriving, before the reader has finished the sentence. It sits between your model call and your UI, passing tokens through until a rule says stop. When that happens, the stream is cut and the partial output never lands on screen. ## Why this approach The usual answer is post-hoc moderation: generate the whole response, score it, then decide. By then the text is already rendered and the user has read it. Watching the stream means the abort happens mid-flight instead of after the fact. The trade-off is that rules run on every chunk, so they have to be cheap, which rules out calling a second model inline. ## How it's built The rules are regex and structural checks, not a classifier model. Each streamed chunk is tested as it passes through, and a match throws an abort that tears down the stream. Keeping the checks to pattern matching is what holds the per-chunk cost low enough to run inline. For apps that don't want to wrap their model call directly, Tripwire also ships an OpenAI-compatible sidecar proxy. Point your client at its `POST /v1/chat/completions` endpoint instead of the provider's, and it streams the response through the guard, aborting mid-stream the moment a rule trips. No SDK change beyond the base URL. ## Known limitations - Rules are regex and structural only. There's no semantic model in the loop. - On long streams the per-chunk checks add roughly 8-15ms each, which accumulates. - It catches banned content, not hallucination. A confident wrong answer sails through. - Complex rules are easy to write badly; a sloppy regex can false-positive on safe text. ## Where it runs - GitHub: github.com/ykstorm/tripwire - npm: @ykstormsorg/tripwire