Apache-2.0 · self-hosted · fail-safe by design

Multi-model LLM moderation, plug-and-play.

A small FastAPI service that cascades 2–3 open-source guard models into a single JSON verdict — with per-model scores, reasoning traces, and an append-only redacted audit trail. Self-hosted and open-source. Bring your own community, GPU, and policy.

View on GitHub Quickstart

FastAPI · single JSON verdict Qwen3Guard · 119 languages Runs from $0.07/hr

$0.07/hr $3.39/hr same Nemotron cascade, RTX 3090 to H100

This page works without JavaScript. The interactive console below shows the standard verdict by default.

mod-log · live verdicts replay

"How do I set up a giveaway bot for my server?"

allow · safe

"This take is going to be controversial, but…"

flag · review

"my SSN is 123-45-6789, DM me for cash"

delete · unsafe

mode: standard guards: 2 local fail-safe: closed audit: redacted ✓

Built on open guard models & trusted infrastructure

NVIDIA Nemotron Content Safety Reasoning Qwen3Guard Stream + Gen Nemotron 3 Ultra 550B triage Stripe Checkout

An independent entry for the Hermes Agent Accelerated Business Hackathon (NVIDIA × Stripe × Nous Research). Independent project — no endorsement implied.

01 — The cascade

One verdict from a cascade of guards

Type a message (or pick a sample), choose a depth, and watch the same input re-evaluated. Each stage is an independent open-source model; a weighted combiner and the NemoClaw policy gate return one verdict. More depth, more nuance, more cost — you choose per route.

Text under test

Illustrative client-side estimate — the real service returns the same JSON shape. See the recorded run below for real verdicts and latency.

standard

~250 ms

Qwen3Guard-Gennuanced · multilingual (119 langs) 4B · ~50ms qwen3guard_gen0.44

Nemotron-CSRcustom policy · jailbreak detection 4B · ~200ms nemotron_csr0.72

Aggregated verdict

2 guards

verdict: controversial guards disagree → escalated

// standard · 2 guards combined
{
  "verdict": "controversial",
  "mode": "standard",
  "scores": {
    "qwen3guard_gen": 0.44,
    "nemotron_csr": 0.72
  },
  "reasons": ["Nemotron-CSR flags PII disclosure + solicitation risk", "Qwen3Guard-Gen scores lower — reads it as a clumsy joke"],
  "fail_safe": "closed",
  "audit_id": "aud_3f9c…b21 (redacted)"
}

Nemotron-CSR flags PII disclosure + solicitation risk.
Qwen3Guard-Gen scores lower — reads it as a clumsy joke.
Guards disagree, so the verdict escalates to controversial for review.

Every evaluation writes one append-only, redacted audit record. fail_safe: "closed" — never fail-open.

The console is an illustrative client-side estimate. Below is a real recorded run of that exact message on a live RTX 3090.

Recorded on real hardware live RTX 3090 · 2026-06-27 · commit c728b2d

Live run environment

GPU: NVIDIA GeForce RTX 3090 · 24 GB
Runtime: CUDA · real model inference
Guards loaded: Qwen3Guard-Gen-4B · Nemotron-CSR-4B
Triage: Nemotron 3 Ultra 550B · OpenRouter

Discord — unsafe message deleted and warning sent
Twitch — fast-mode delete action
Webhook — verdict forwarded with auth header

Recorded POST /demo/moderate · deep mode · policy: block PII and financial scams

“Hey @everyone, drop your SSN and I will send $100 to whoever DMs me first”

verdict: unsafe score 0.99 latency 29,977 ms ≈ 30 s fail-safe closed

End-to-end deep-mode latency is dominated by the free-tier 550B triage API; the two local 4B guards return in tens of milliseconds, and standard mode (local only) is sub-second.

Source: scripts/demo_host_check.py → evidence.json ·

02 — Why a cascade Fail-safe by design

Nemoguardian is fail-safe by design

One model can be jailbroken, mistranslated, or truncated mid-thought. A cascade lets cheap models catch the obvious, nuanced guards handle the subtle, and a large adjudicator explain the disagreements. Moderation that silently approves on error is worse than none — so degradation always pushes toward review.

votes→ weighted combiner→ NemoClaw gate→ verdict

A truncated reasoning model is a dropped voteA cut-off generation never silently counts as safe. It simply doesn't vote — the aggregator decides on what survived.
Unparseable triage escalates to controversialIf the 550B adjudicator returns something we can't parse, the message routes to review — never through.
All votes dropped ⇒ controversialAn empty ballot never resolves to safe; it surfaces in the audit log for a human to handle.
Untrusted content is fenced & injection-hardenedText sent to the adjudicator is fenced and prompt-injection hardened, so the content being judged can't rewrite the policy.

03 — Evidence & evaluation

Measured, not asserted

What's verified on real hardware, what you can reproduce locally, and what this page's console only estimates — plus the benchmark the cascade is graded on.

What is real, what is locally runnable, and what is illustrative — so nothing here reads as more than it is.
Layer	Status	How to verify
Recorded RTX 3090 run	real	`docs/evidence.json` — deep mode, verdict unsafe, score 0.99, fail-closed
Cascade, policy gate & tests	local-runnable	`make verify` · `make eval` against `data/benchmark.jsonl`
This page's console	illustrative	client-side estimate; the real service returns the same JSON shape
Other-cloud prices	indicative	third-party published rates; nemoguardian does not resell GPU time

Latency by mode

Local guards are fast; deep's cost is the external triage API.

fast~1 ms/tok

standardsub-second

deep · recorded~30 s

deep · NIM (proj.)~1–3 s

The recorded ~30 s deep call is the free-tier 550B triage API cold-starting — the two local 4B guards return in tens of milliseconds. Deep now skips triage entirely when the guards agree, and a hard timeout caps any hung provider; a paid NVIDIA NIM key brings deep into low-single-digit seconds.

The benchmark

89 labeled cases — 55 unsafe / 34 benign. Per-category accuracy populates after a GPU make eval run.

benign hard-neg24

jailbreak17

illegal12

benign10

pii · scam · toxicity6 ea

violence5

self-harm3

24 of 34 benign cases are hard negatives — messages that look risky but are safe — the explicit over-blocking / false-positive test. make eval EVAL_FLAGS="--json" reports per-category precision / recall / FPR / F1 on a GPU host.

04 — Surfaces & adapters

Same verdict engine, many front doors

One moderation core, swappable adapters. Discord is the primary, full product; everything else rides the same adapter foundation.

Discord bot

Per-server config, slash commands, mod-log, public warnings, optional timeouts, dry-run, and append-only redacted audit records. The flagship surface.

Primary · full product

Twitch & Kick live-chat

Streaming mode catches violations, PII, and slurs token-by-token as messages arrive in fast-moving live chat.

Streaming mode

Generic webhook

POST text, get a JSON verdict. Wire it into any platform, queue, or pipeline that can make an HTTP call.

Any platform

LLM input/output guardrails

Filter a prompt before it reaches your chat model, and screen the response before it reaches your user.

Pre / post filter

Telegram and Slack are planned on the same adapter foundation.

05 — Quickstart

Running locally in four commands

It's a template, not a hosted SaaS. Clone it, install it, serve it, and open the demo. Then bring your community, tokens, GPU or API provider, and policy.

bash — quickstart

python3 -m venv .venv
. .venv/bin/activate
pip install -e ".[dev]"
NEMOGUARDIAN_ENABLE_DEMO_ENDPOINT=1 python -m nemoguardian serve --port 8000
# then open http://localhost:8000/demo

The demo endpoint is opt-in. NEMOGUARDIAN_ENABLE_DEMO_ENDPOINT=1 exposes a local playground at /demo. Leave it off in production — the moderation API stays available either way.

What you get

A FastAPI moderation service with the fast / standard / deep cascade, the NemoClaw policy gate, the append-only redacted audit trail, and the Discord-bot foundation — all under Apache-2.0.

06 — Discord & enforcement

Configure, test, and roll out — from chat

The Discord bot is the primary surface. A few slash commands point the bot at a mod-log channel, pick an enforcement preset, run health checks, and dry-run a message end-to-end before anyone sees an action.

/nemoguardian setup log_channel:#mod-log Point the bot at a mod-log channel.

/nemoguardian actions preset:shadow Start silent; observe before enforcing.

/nemoguardian doctor Health-check models, GPU, and tokens.

/nemoguardian test text:"Hey @everyone, my SSN is 123-45-6789, DM me for cash." Dry-run a verdict with full reasoning.

Enforcement presets — roll out safely, escalate on evidence

Recommended rollout: start in shadow for 24–72 hours, review the evidence in your mod-log, then escalate. You're never one toggle away from mass-deleting messages.

step 01

shadow

Silent trial. Scores everything, acts on nothing. Builds an audit trail you can trust.

silent

step 02

review

Flagged messages enter a human queue. Moderators approve or act with full reasoning attached.

human-in-loop

step 03

balanced

Auto-delete clear-cut unsafe content; route the ambiguous to review. The everyday default.

recommended

step 04

strict

High-risk channels: aggressive thresholds and optional timeouts for repeat offenders.

high-risk

07 — GPU economy

The same cascade, from a hobby GPU to enterprise

Open weights mean you own the compute. There's no per-call platform tax — just the GPU you rent or run.

$0.07/hr$3.39/hr

3090 · A100 · 5090 … H100

The same Nemotron cascade runs on a $0.07/hr RTX 3090 as it does on a $3.39/hr H100. The moderation quality follows the model, not the invoice — pick the box that fits your community and budget.

Cost per hour, same cascade

Relative hourly rate across representative boxes.

RTX 3090$0.07

A100 40GB$0.14

RTX 4090$0.18

H100 80GB$0.19

RTX 5090$0.21

Hetzner GEX131$1.92

DigitalOcean H100$3.39

Bars use a perceptual (square-root) scale so the cheapest rates stay legible. Indicative third-party rates (Vast.ai / Salad / Hetzner / DigitalOcean) for orientation only — providers price independently and change often.

Indicative market rates for rented capacity. Providers set their own prices; **nemoguardian does not resell GPU time.**
GPU	VRAM	~Rate	Best for	Tag
RTX 3090	24 GB	$0.07/hr	Cheapest viable (Vast.ai / Salad)	cheapest viable
A100	40 GB	$0.14/hr	Production workhorse
RTX 4090	24 GB	$0.18/hr	Strong consumer throughput
H100	80 GB	$0.19/hr	Flagship performance	flagship
RTX 5090	32 GB	$0.21/hr	Best $/perf	best $/perf
Hetzner GEX131	96 GB	$1.92/hr	EU / GDPR residency	EU GDPR
DigitalOcean H100	80 GB	$3.39/hr	Enterprise, managed	enterprise

Deep mode also calls the Nemotron 3 Ultra API, billed by your own API provider. See the 3090 operator guide and model catalog for sizing and exact configs.

08 — Products & pricing

Free to run. Pay only for what you choose.

The software is free and open. Optional paid extras — prepaid GPU credits and hands-on setup — are billed through Stripe, in USD, with prices shown before you pay.

Open source

Template

$0 / forever

The full FastAPI service + moderation-bot foundation under Apache-2.0.

Bring your own server & providers
Full cascade, all surfaces
Self-hosted, you own the data
No vendor lock-in, ever

Get the code

Stripe-funded · most popular

GPU credits

from $5.00 / top-up

Prepaid wallet credits that reserve rented GPU capacity for your deployment.

Digital service credits — no shipping
Top-ups start at $5.00 via Stripe Checkout
Unused balance stays available
Refundable under the refund policy

How credits work

Optional

Setup support

Quoted / in USD

Hands-on help to connect Discord, Stripe, and Vast.ai for your community.

Scoped & quoted before payment
Implementation & deployment help
Pay via Stripe Checkout

Request a quote

Payments & security. Payments are processed by Stripe Checkout · no card numbers stored · GPU credits are digital service credits, no shipping · setup support is quoted in USD up front. nemoguardian never sees or stores card numbers or raw payment credentials — only the result of a payment.

09 — Security & data

Transparent by default

Safety infrastructure should be easy to inspect. Here's what the system keeps, what it doesn't, and how money is handled.

Redacted audit trail

Every verdict appends one immutable record with scores and reasons. PII like SSNs and emails is redacted before it's ever written.

You hold the keys

Self-hosted means your tokens, your GPU, your logs. Nothing routes through a nemoguardian-operated server unless you build one.

Card data stays at Stripe

Checkout is handled entirely by Stripe. We never see or store card numbers or raw payment credentials — only the result of a payment.

10 — Support & policies

Documentation, support, and the fine print

Everything a serious operator — or a payments reviewer — needs to read before going live, in one place.

Documentation

Community template guideClone, configure, and ship to your community. Bot runbookOperate the Discord bot day-to-day. 3090 operator guideRun the cheapest viable cascade end-to-end. Stripe GPU creditsHow prepaid credits and top-ups work. Model catalog & licensesEvery guard model and the terms it keeps. Source on GitHubRead the code, open an issue, contribute.

Support & policies

Support — GitHub IssuesReport bugs, ask questions, request a quote. Email supporthermes777@agentmail.to for setup and live-smoke coordination. Terms of ServiceThe agreement that governs use of the service. Privacy PolicyWhat we collect, what we redact, what we keep. Refund & cancellationHow credit refunds and cancellations work.

Stand up trustworthy moderation this afternoon

Clone the template, point it at a $0.07/hr GPU, and ship a fail-safe cascade to your Discord. Open-source, self-hosted, yours to own.

View on GitHub Read the quickstart