work / pipecat-firewall

pipecat-firewall

Blocks prompt injection and PII extraction before your voice agent’s model ever sees the turn. One line to adopt, no API key, no added latency.

A blocked turn never reaches your model, so there is no prompt for the attacker to negotiate with.

Status
Published · pip install pipecat-firewall
Package
pypi.org/project/pipecat-firewall ↗
Stack
Python · MIT · CI on GitHub Actions
Source
github.com/rushjais/pipecat-firewall ↗

01  The idea

Building Envoy and Sentry, I kept writing the same defensive layer twice. Both projects needed to stop a caller from talking a voice agent into leaking a card number, and both solved it inside the agent’s prompt — which is exactly the wrong place, because a prompt is something an attacker gets to argue with.

So I pulled it out into a package. pipecat-firewall reads each caller turn before the LLM runs and blocks, flags, or redacts it.

The design choice that matters: the default detectors are curated regex and phrase matching, not a model. That means microseconds instead of a round-trip, no API key, no extra bill, and — most importantly — deterministic behaviour you can write a test for.

02  How it works

Caller turnfrom STTFirewallregex + phraseµs, no model callYour LLMclean turnsRedactPII strippedCanned refusalnever hits the LLMResponsespoken backpassflagblock
Three outcomes per turn. The block path is the important one: it answers with a fixed string and never invokes the model, so there is nothing to jailbreak. Schematic — boxes illustrative, not to scale.

03  Try to get past it

These are the package’s real detectors, ported line-for-line from signals.py and running in your browser. Type an attack, or pick one, and watch what the agent’s model would never have seen.

SentryFirewall · mode=block · 3 inbound detectors

Runs entirely client-side. No network call, no model, no API key — which is the point: these detectors cost microseconds and cannot be talked around.

04  Design decisions

  • Deterministic beats clever. An LLM-based guard is another model that can be talked around, and it doubles your latency and cost. Curated pattern matching is boring, fast, and testable — and it catches the attacks that actually show up.
  • Refusals that bypass the model. On a block the agent speaks a canned line. Because the LLM was never invoked, there is no context window for the attacker to manipulate.
  • One line to adopt. If a security tool is hard to install, it does not get installed. It drops into an existing Pipecat pipeline as a frame processor.
  • Published properly. Versioned on PyPI, MIT licensed, CI on every push. Extracting it from two projects and packaging it for strangers forced the API to be smaller than either project had.

Honest limits. Pattern matching is a floor, not a ceiling — it catches known attack shapes and will miss a genuinely novel phrasing, which is exactly what Envoy’s self-heal loop was built to handle. Treat it as defence in depth, not as the only layer. The detector set is curated by me and reflects the attacks I have seen.