allow / deny cannot.
This page is the comparison. Each integration page repeats its own row, with the
detail, so you do not have to come back here mid-setup.
What a collector can apply
TrustGuard resolves every evaluation into one policy status. Four of them ask something of the collector, listed most restrictive first — the order the reducer itself uses,block > ask > transform > report > allow:
Redaction is the scarce one. To honour
transform, the host has to own the
payload and be able to write it back. Most integration contracts return a
boolean verdict, so transform collapses to allow or deny there.
Ask is the one that collapses. It needs a person at a keyboard, which only
the developer-machine plugins have. It is not a column in the matrices below,
because it does not vary by surface the way the other three do — it varies by
whether the collector can prompt anyone at all, and it never applies on output.
Where there is nobody to ask, each integration resolves it differently, and the
difference matters:
Legend for the matrices: ✅ supported · ⚠️ conditional · ❌ not supported · ➖ the
surface does not exist for this collector.
Every collector
One row per collector, in the same order in all three tables on this page. Category is the group it sits under in these docs.
Categories are not exclusive, and most deployments need more than one. A gateway
collector covers your own AI products; an IDE collector covers what developers
and their agents do; neither sees the other.
LLM interactions
Input is the request sent to the model provider — prompts, tool definitions, tool call arguments and tool results. Output is the model’s response. One table each, so neither needs scrolling sideways to read.Input
Output
TrustGate is the only collector that inspects streaming responses. Its
post_response stage buffers the stream and inspects it after the client drain.
On the other gateways, output coverage is over non-streaming completions.
LiteLLM and Portkey redaction is version-gated. Both need their native
neuraltrust guardrail, contributed but not yet in a release. What ships today —
LiteLLM’s custom guardrail file, Portkey’s BYOG webhook — enforces block and
does not apply transform.
Azure APIM is input-only until you add the outbound policy, which is why its
output column is conditional rather than supported.
CloudFront truncates an oversized viewer-request body silently, so a long
prompt is evaluated only in part — monitoring is partial, not absent.
Copilot prompts are audit-only. Copilot discards command-hook output at
userPromptSubmitted, so a prompt is recorded but cannot be stopped there.
Enforcement happens at the tool events.
Tool-level interactions
These collectors apply policy between an agent and its tools — MCP servers, shell, patches. The call is what the agent is about to do; the result is what the tool sends back.Tool call
Tool result
The middleware collectors see HTTP routes, not model or tool calls, which is why
they have no tool surface at all while the SDKs do.
Tool declarations are a TrustGate and MCP concern. Tool listings —
descriptions and parameter schemas, where
tool poisoning hides — are scored by
indirect prompt injection over LLM
tools[] and MCP tools/list, but only where
the integration actually sends them: TrustGate,
LangChain over the agent’s bound tools, and
Claude Enterprise, where the
declarations are visible in the transcript but can only be stopped by denying the
whole inference. The developer-machine plugins send tool calls and results,
not the tool list, so tool-poisoning detection does not apply on the surface
closest to the developer. Route MCP through
TrustGate to cover it.Considerations
TrustGate — the only collector with the full surface. On transport errors and 5xx it fails open unless the policy sets fail-closed; auth and entitlement failures always block. In observe mode atransform is logged, not applied. A
transform that cannot be applied safely blocks rather than forwarding unmasked.
An ask is enforced like a block, since there is nobody at a gateway to prompt;
the other gateways forward it instead.
Portkey — the native plugin holds the request body, so it consumes
transformed_payload on chat completions, text completions and Anthropic
Messages, on non-streaming responses. A streamed response is not inspected on
the output side at all, rather than inspected late. Enforcement needs
deny: true on the hook — without it a failed check is recorded and the request
is returned anyway. The plugin also inverts the engine’s default: Portkey forgives
a check that errored unless failOnError is set, so the plugin reports an
unreachable TrustGuard as a failed verdict instead of an error, which the engine
cannot forgive. Auth and entitlement failures stay fail-closed even under
fail_open.
LiteLLM — the native guardrail consumes transformed_payload, so it is the
only gateway besides TrustGate that can redact, on non-streaming completions and
once the release carrying it ships. Tool declarations and tool calls reach the
payload where LiteLLM populates them and a transformed tool call is written back,
but every verdict is request-level, so a tool-level finding blocks the whole
request. Auth and entitlement failures stay fail-closed even under fail_open.
Kong — needs AI Proxy on the route. The verdict maps onto a boolean, so
redaction cannot travel.
Apigee — coverage is per proxy unless you attach the Shared Flow with an
environment flow hook. The verdict maps onto a boolean, so redaction cannot
travel.
Azure APIM — input-only until you add the outbound policy. The verdict maps
onto a boolean, so redaction cannot travel.
Claude Enterprise — allow or deny on a whole inference, and nothing else. No
redaction, no ask, no output coverage. Tool content is visible in the
transcript and can be blocked, but only by denying the whole inference at the
single pre-inference decision point: there is no per-tool verdict. Attachments
arrive as metadata and extracted text, never raw bytes.
Claude Code, Cursor, Codex, Copilot — none of them sees the model’s response,
system prompts, token usage or extended thinking: they capture what passes
through hook events. None supports redaction — transform becomes a permission
decision, so a masking policy warns or blocks instead of masking. They differ on
ask, which is where the choice between them usually lands — see the table
above.
LangChain — runs inside your agent rather than on the network, so it sees
only what it is installed in. It applies transform by rewriting messages in
place, and check_tool_calls is the one hook anywhere that stops a tool call
before it executes; output redaction is conditional because a streamed response
has already reached the client.
n8n — routes the verdict to a named output instead of enforcing it, so every
capability past monitoring depends on how the workflow is wired: a Block
branch reconnected to the agent is monitoring. It has no hook inside an AI Agent
node’s loop, so tool coverage is only what the graph makes explicit.
Application — every capability is reachable because you hold the payload, and
none is automatic. Code that logs a block and calls the model anyway is
monitoring; code that ignores transformed_payload forwards unmasked data. The
middleware variants see HTTP routes, not model calls, so background jobs and
queue consumers bypass them.
Edge / WAF — the documented integrations inspect the request body and return
403 on block; the response path is not inspected. They protect your own
applications, not employee use of third-party AI.
Choosing
Start every collector in report policy mode. Confirm traffic reaches
Activity, review findings over a representative period, then enable blocking
and transform actions.