wrap(), while Google ADK uses a dedicated plugin.
OpenAI
Wrap anOpenAI client to route completions through the guardrails proxy.
Anthropic
Wrap anAnthropic client the same way.
Google GenAI
Wrap aGoogleGenAI client. Set your Gemini key the way you normally would (shown here on the client). The SDK does not require any additional LLM provider key of its own.
The SDK normalizes the gateway URL with a trailing slash for Google GenAI — do not add one yourself.
LangChain
wrap() auto-detects LangChain chat models, extracts the underlying SDK client, and applies guardrails routing. Supported models:
ChatOpenAI(from@langchain/openai)ChatAnthropic(from@langchain/anthropic)ChatGoogleGenerativeAI(from@langchain/google-genai)
- ChatAnthropic
- ChatGoogleGenerativeAI
Google ADK
ADK agents lazily create their GenAI client at runtime, sowrap() cannot be used. Use ADKGuardrailsPlugin to configure guardrails routing at the agent level:
- Routing —
contentConfigdirects LLM traffic through the guardrails proxy. - Identity —
beforeModelCallbackattaches the ADK session ID as anX-Agent-Session-Idheader on each call. - Error handling — the static
ADKGuardrailsPlugin.onModelErrorconverts guardrails blocks into anLlmResponsethe agent can handle gracefully.
contentConfig cloning caveat.
Version compatibility
Pin your provider SDK to the tested ranges to avoid breakage from private API changes:
For the three LLM SDKs,
wrap() resolves the installed version and throws if it falls outside the supported range.
Known limitations
- Private attribute mutation —
wrap()redirects traffic by rewriting each client’s base URL and injecting the guardrails headers (X-FlintAI-API-Key,X-Guardrails-Policy-Id). For OpenAI and Anthropic this uses the internal_options.defaultHeaders, and for Google the internalapiClient.clientOptions.httpOptions. These internal attributes are not part of the providers’ public APIs and may change without notice, so pin your provider SDK versions to the tested ranges. - Google GenAI URL normalization — the Google GenAI SDK requires a trailing slash on the base URL. The SDK adds it automatically — do not add one to
gatewayUrl. - Multiple provider keys in environment — if several provider API keys are set (
OPENAI_API_KEY,ANTHROPIC_API_KEY,GOOGLE_API_KEY), auto-detection fails. Passproviderexplicitly toinit().
Next steps
Usage
Advanced patterns, error handling, and best practices
Configuration
Environment variables, credentials, and gateway setup