Skip to main content

Guardrails

Guardrails validate and shape the payloads flowing through the AI Gateway: MCP tool calls, resources and prompts, and the HTTP APIs the MCP Gateway proxies as MCP tools. Rather than a bespoke filtering layer, Guardrails reuse the same catalog and model primitives Zilla already uses to govern Kafka message data in Kafka Gateway's data governance.

  • Validate rejects a payload that doesn't conform to a schema or type, before it reaches an agent or an upstream server.
  • Transform changes a payload's representation, so an agent and an upstream don't have to agree on the same wire format.

Both build on two resources:

  • Schema Registry defines where a schema lives: embedded in zilla.yaml, read from the local filesystem, or fetched from a remote schema registry.
  • Schema Enforcement defines the type or schema a payload is checked against, from primitives like string and int32 to schema-backed formats like avro, json, and protobuf.

Guardrails apply directly on AI-Gateway-specific bindings, not only illustratively through the http binding:

  • The mcp proxy binding's options.tools validates tools/call request arguments against a model.
  • The mcp-http proxy binding's options.tools.<name>.schemas.input/schemas.output validate and convert a tool's arguments and the upstream HTTP response, each bound to a model and catalog.

See Validate and Transform for the exact configuration on each.

Next Steps

  • Validate walks through rejecting a malformed tool call or upstream response.
  • Transform walks through transforming a payload between wire and view formats.