Skip to main content
Plugins transform the request, the response, or stored traces as the AI Gateway handles a call. This sets plugins apart from Guardrails, which only observe and block. Each plugin carries an id discriminator, and attaches per request through the plugins array, per routing rule, or for the whole workspace under Settings > Plugins.

PII Redaction

Mask personal data before the provider sees it.

Response Healing

Repair malformed JSON before the response reaches the caller.

Trace Scrubbing

Mask stored traces without changing live traffic.

Signals

Score finished replies for quality and safety in the background.

​
PII Redaction

Replaces personally identifiable information with placeholders before the provider sees it, then restores the original values in the response. The workspace toggle carries a gear that sets the language, regions, entity types, thresholds, and failure handling. See PII Redaction for configuration and failure modes.

​
Response Healing

Repairs malformed JSON in model output: code fences, trailing commas, unquoted keys, and missing brackets. It takes no configuration, and runs on non-streaming requests only, since a streamed response has no complete body to repair. See Response Healing.

​
Trace Scrubbing

Masks selected fields in stored traces without changing the live request or the payload the provider receives. An MCP gateway takes it as well. The workspace toggle carries a gear that selects the surfaces to mask, and a toggle saved without masks scrubs every surface. See Trace Scrubbing.

​
Signals

Signals scores finished replies in the background, so quality and safety problems surface without an evaluator call from the application.
  • It runs on traced gateway calls: span.responses, span.chat_completion, and span.completion spans whose turn finished with stop, length, or end_turn. Errored spans, agent runs, and Signals’ own calls are skipped. Workspace tracing must be on.
  • It needs a Classify model. The workspace toggle stays disabled until one is available, and the configuration panel selects the models to classify with.
  • The checks are Jailbreak, Prompt injection, Unsafe output, Regulated advice, System prompt leakage, Laziness, Task adherence, Groundedness, User correction, and User frustration. Each takes an optional threshold between 0 and 1.
  • A check runs only when its input exists: a check that reads tool results is skipped when the span holds none, and a check that reads system instructions is skipped when the request carries none.
  • Results appear in the Signals column of the traces table and on the span as orq.signals.
  • A routing rule that attaches a signals plugin replaces the workspace configuration for the calls the rule matches.

​
Supported endpoints

The plugins array is accepted on the following AI Gateway endpoints: