Coverage

TrustGuard returns a policy verdict. Each integration applies that verdict using the capabilities of its host platform. A gateway that owns the request body can forward a masked payload; a provider hook limited to allow or deny cannot. TrustGate appears here through its native collector, which evaluates traffic routed through the gateway.

​

Policy actions

TrustGuard resolves every evaluation into one policy status. When an evaluation produces multiple statuses, TrustGuard applies the most restrictive one in this order: block > ask > transform > report > allow. Redaction requires the host to own and modify the payload. Integrations that return only a boolean verdict cannot apply transform directly. The ask action applies only to input. Interactive development tools may show an approval prompt; noninteractive integrations must map the status to allow or block:

​

Collectors

Collectors cover different traffic paths. A gateway collector covers your AI services, while a coding-agent collector covers developer and agent activity on local machines. Neither sees the other’s traffic.

​

LLM interactions

Legend: ✅ supported; ⚠️ conditional; ❌ not supported; ➖ the collector does not expose this surface. Input is the request sent to the model provider, including prompts, tool definitions, tool-call arguments, and tool results. Output is the model’s response.

​

Input

​

Output

Streaming responses: TrustGate inspects a streamed response after it has been delivered to the client, so findings on streamed output are monitor-only. The other gateway integrations cover only non-streaming responses. Azure APIM output: Input redaction uses transformed_payload.input. Output coverage requires the outbound policy and does not support redaction. CloudFront request size: Include Body exposes up to 40 KB on a viewer-request trigger or 1 MB on an origin-request trigger. Origin request runs after the cache lookup and only for requests forwarded to the origin. CloudFront sets inputTruncated when the body exceeds the applicable limit, so the handler must reject or otherwise account for truncated input before enforcing a policy. Copilot prompts: Copilot discards command-hook output at userPromptSubmitted, so a prompt is recorded but cannot be stopped there. Enforcement happens at the tool events.

​

Tool-level interactions

These collectors apply policy between an agent and tools such as MCP servers, shell commands, and patches. A call is the action the agent is about to take. A result is the content returned by the tool.

​

Tool call

​

Tool result

Tool-result hooks run after the tool call and cannot undo it. Claude Code and Codex can return a block decision and reason as post-tool feedback, but they do not replace the result content. Cursor adds the finding as an untrusted-content warning and does not return a permission decision. GitHub Copilot support is conditional because result replacement works only with its native payload. Middleware collectors see HTTP routes rather than model or tool calls, so they do not expose tool-level coverage. SDK integrations can send tool events explicitly.

​

Integration limitations

TrustGate: Covers LLM and MCP input and non-streaming output inline. Streamed output is monitored after delivery. Transport and service errors follow the policy’s on_error setting, which defaults to fail_open. Authentication, rate-limit, and entitlement responses always block. In Observe mode, transform is logged but not applied. A transformation that cannot be applied safely blocks rather than forwarding unmasked content. Portkey: The BYOG webhook converts the TrustGuard status to Portkey’s boolean verdict. Enforcement requires deny: true on the hook. The webhook does not apply transformed_payload, and streamed responses are not inspected. LiteLLM: The custom guardrail runs before and after model calls and applies verdicts at the request level. It does not apply transformed_payload. Streaming output cannot be blocked after chunks have been sent. Kong: Requires AI Proxy on the route. Its boolean verdict does not support redaction. Apigee: Coverage is per proxy unless you attach the Shared Flow through an environment flow hook. Its boolean verdict does not support redaction. Azure APIM: The inbound policy supports redaction by replacing the request body with transformed_payload.input. Add the outbound policy to inspect model responses; output redaction is not supported. Claude Enterprise: Returns allow or deny for an entire inference. It does not support redaction, ask, output evaluation, or per-tool verdicts. Tool content in the transcript can be blocked only by denying the entire inference. Attachments arrive as metadata and extracted text rather than raw bytes. Claude Code, Cursor, Codex, and Copilot: These integrations capture lifecycle hook events, not model responses, system prompts, token usage, or extended thinking. They do not support field-level redaction. A transform verdict becomes a warning or permission decision instead. For a native Copilot payload, the tool-result hook replaces the entire output with [Tool result redacted by TrustGuard]; it does not mask individual spans. See the ask table above for approval behavior. LangChain: Runs inside the agent and covers only the application where it is installed. It applies transform by rewriting messages in place, and check_tool_calls can stop a tool call before execution. Output redaction is conditional because streamed content may already have reached the client. n8n: Routes the verdict to a named output instead of enforcing it. Blocking and redaction depend on the workflow connections. For example, reconnecting a Block branch to the agent allows the interaction to continue. The integration has no hook inside an AI Agent node’s loop, so it covers only tool activity made explicit in the graph. Application integrations: Your code owns the payload and must enforce each verdict. Logging a block before calling the model provides monitoring only. Ignoring transformed_payload forwards the original data. Middleware covers HTTP routes, so background jobs and queue consumers bypass it. Edge / WAF: These integrations inspect request bodies and return 403 on block. They do not inspect responses and cover only applications you operate.

​

Choose an integration