Home

lexvault is a LiteLLM proxy plugin that swaps an enterprise's own dictionary terms for deterministic placeholders on the request path and restores them on the response path — with zero un-restored placeholders reaching the client and zero originals reaching the upstream LLM or logs.

The trust boundary¶

Classic PII redaction is saturated. lexvault fills the wedge that incumbents miss: reversible pseudonymization for an enterprise's proprietary knowledge, with correct round-trip handling across tool calls and streaming — exactly where the leading gateway's own path fails (BerriAI/litellm#22821).

Your dictionary and mapping vault never leave your boundary by default.

60-second quickstart¶

pip install lexvault

# config.yaml — mount next to lexvault_shim.py
model_list:
  - model_name: gpt-4o
    litellm_params:
      model: openai/gpt-4o
      api_key: os.environ/OPENAI_API_KEY

guardrails:
  - guardrail_name: lexvault
    litellm_params:
      guardrail: lexvault_shim.LexVaultGuardrail
      mode: [pre_call, post_call]
      default_on: true
      dictionary_path: dictionary.yaml
      org_key: os.environ/LEXVAULT_ORG_KEY

litellm --config config.yaml

→ A request mentioning Project Titan reaches the upstream LLM as [LEX-NZNH3BZX], and the response is restored before it reaches your client. See the full quickstart →

Feature surface¶

Non-streaming OpenAI (/v1/chat/completions)
Non-streaming Anthropic-native content blocks + tool_use.input (/v1/messages)
OpenAI tool_calls[].function.arguments
Streaming OpenAI ModelResponseStream
Streaming Anthropic-native raw SSE bytes (re-framed + restored)
/v1/responses text (Responses API)
NER / embeddings / GLiNER detection (v0.2)
Standalone ASGI proxy mode (v0.2)

Explore the concepts → Docker quickstart →