Metadata-Version: 2.5
Name: whiteout-litellm
Version: 0.1.0
Summary: Whiteout guardrail for the LiteLLM Proxy — govern every app behind the gateway
Project-URL: Homepage, https://whiteout.groovysec.com
Project-URL: Documentation, https://docs.whiteout.groovysec.com/gateways/litellm
Author-email: Groovy Security <engineering@groovysec.com>
License-Expression: Apache-2.0
License-File: LICENSE
Requires-Python: >=3.9
Requires-Dist: whiteout-ai>=0.3.0
Description-Content-Type: text/markdown

# whiteout-litellm

The Whiteout guardrail for the [LiteLLM Proxy](https://docs.litellm.ai/docs/proxy/guardrails/custom_guardrail). Add it once, and every app that calls models through the proxy is governed. The apps themselves don't change.

```bash
pip install whiteout-litellm
export WHITEOUT_GATEWAY_KEY=wo_gw_prod_...          # Whiteout → Custom AI Apps → Gateways
export WHITEOUT_BASE_URL=https://api.whiteout.groovysec.com
```

```yaml
# config.yaml
guardrails:
  - guardrail_name: whiteout
    litellm_params:
      guardrail: whiteout_litellm.WhiteoutGuardrail
      mode: [pre_call, post_call]
      default_on: true
```

**What it checks:**
- **Before the model call:** the prompt, the system prompt and tool results. Tool turns that Prompt Injection Defense quarantines are replaced before the model sees them.
- **After the call:** the reply. Streams are held until the reply passes.

A block reaches the caller as LiteLLM's usual guardrail error (HTTP 400).

**Which app a request belongs to** comes from the request's `metadata.app`, then the team alias, key alias or team id. Apps seen for the first time appear under **Custom AI Apps** as *Discovered*, for an admin to confirm.

If Whiteout is unreachable, the gateway's fail behaviour applies. That's fail-open unless your admin chose fail-closed.

| Variable | Default |
|---|---|
| `WHITEOUT_GATEWAY_KEY` | required; without it, requests pass through ungoverned (logged) |
| `WHITEOUT_BASE_URL` | `https://api.whiteout.groovysec.com` |
| `WHITEOUT_SCAN` | `user,system,tool` |
