Crate guard_core_rs 

Framework-agnostic application-layer API security engine.

Rust port of guard-core’s detection engine. Work in progress: the CPU-bound detection pipeline is the core, and the first pipeline stage has landed: the rate-limit and dynamic-ban tower layer for Axum/tonic-shaped stacks. Handlers, protocols, decorators, and other I/O layers are not yet ported.

Re-exports the detection engine modules:

• detection_exclusions - the per-route detection exclusion resolution and the multi-surface request scan (scan_request): excluded headers/params/body fields, enabled detection categories, and the detection scan-body toggle, resolved from the global config and the route config exactly as the reference’s _resolve_* helpers do
• compiler - regex pattern compilation with LRU caching and ReDoS safety validation
• detect - the spec 4.0.2 detection pipeline entry point (detect, detect::DetectConfig, detect::DetectVerdict)
• preprocessor - unicode NFKC normalization, URL/HTML decoding, null byte removal, whitespace collapsing, and attack-preserving truncation
• semantic - token extraction, Shannon entropy, encoding layer detection, attack probability scoring, obfuscation detection, code injection risk analysis, and aggregate threat scoring
• cloud_provider - the cloud-provider blocking pipeline stage as a tower::Layer (403 “Cloud provider IP not allowed”, region carve-outs, skip-state aware)
• geo - the geo country blocking pipeline stage as a tower::Layer (403 “Forbidden”, loopback exemption, whitelist-skip only)
• tower - the rate-limit and dynamic IP ban pipeline stage as a tower::Layer (429 throttled shape, 403 banned shapes, exempt-IP handling, the auto-ban feeds, and passive mode)
• request_limits - the request size and content-type pipeline stage as a tower::Layer (413 size shape, 415 content-type shape, fail-secure 500 on a junk content-length)
• headers_auth - the required-headers and authentication pipeline stage as a tower::Layer (dynamic 400 required-header shapes, fixed 401 authentication shape, route rules with a global verifier fallback)
• event_types / events - the reference EVENT_* constants and the SecurityEventBus hook seam over the reference SecurityEvent record
• responses - the reference custom_error_responses map and the on_block block hook with the reference payload and exclusion set
• logging - the reference log_activity line shapes with the muted_check_logs and log_sensitive_* redaction knobs
• redact - the merged sensitive-name sets and the [REDACTED] redaction the log lines run through

Usage

use guard_core_rs::preprocessor;
use guard_core_rs::semantic::AttackKeywords;
use guard_core_rs::semantic::AttackStructures;
use guard_core_rs::semantic::{self};

let raw = "<scr\u{200B}ipt>alert(1)</script>";
let clean = preprocessor::preprocess(raw, 10_000, true);

let kw = AttackKeywords::default();
let st = AttackStructures::default();
let result = semantic::analyze(&clean, &kw, &st);
let score = semantic::get_threat_score(&result);

assert!(score > 0.0);

Modules

cloud_fetch

The cloud-provider and GeoIP fetchers: the wire half of the reference cloud lifecycle.

cloud_provider

The cloud-provider blocking pipeline stage for tower stacks.

compiler

composite

The composite telemetry seam: the CompositeAgentHandler, OtelHandler, and LogfireHandler ports plus the TelemetryHandler sink trait they fan out over.

custom_checks

The custom function pipeline stage for tower stacks: the reference pipeline’s custom_request and custom_validators checks.

decorators

The reference decorator system (guard_core/decorators/*.py): the SecurityDecorator registry and its mixin method surface, ported method for method.

detect

Public detection entry point: the spec 4.0.2 SusPatternsManager.detect pipeline (preprocess, four scan views, semantic analysis, scoring).

detection_exclusions

Per-request detection exclusion resolution and the multi-surface request scan.

dynamic_rules

The DynamicRuleManager port (handlers/dynamic_rule_handler.py + _dynamic_rule_snapshot.py).

emergency_mode

The emergency-mode pipeline stage for tower stacks.

enrichment

The event enrichment layer: the reference enricher.py (EventEnricher + ThreatScorer) and the ENRICHMENT_KEY_* family from event_types.py.

event_types

The reference EVENT_* constants, byte-identical string values.

events

The reference event surface: the exact EVENT_* names and the SecurityEvent fields, plus the SecurityEventBus hook seam.

geo

The geo country blocking pipeline stage for tower stacks.

geo_lifecycle

The GeoIP and cloud refresh lifecycles.

headers_auth

The required-headers and authentication pipeline stage for tower stacks.

https_enforcement

The HTTPS enforcement pipeline stage for tower stacks.

live

The stages a dynamic rule can change, rebuilt from the live config.

logging

The log_activity port (guard_core/_utils/request_logging.py): the guard log lines with the reference wording, the redaction sets, the per-check log levels, and the muted_check_logs mute list.

metrics

The reference metrics surface: the exact METRIC_* names, the SecurityMetric telemetry record, and the MetricsCollector that mirrors guard_core/core/events/metrics.py.

mmdb

A minimal, dependency-free MaxMind MMDB reader.

preprocessor

Content preprocessing ported from guard_core/detection_engine/preprocessor.py.

process_response

The response-side pass, ported from the reference process_response.

redact

The log-line redaction port: the reference’s sensitive-name defaults and the redaction the guard log lines apply (guard_core/_utils/request_logging.py).

referrer

The route referrer gate: the reference pipeline’s eighth check.

request_limits

The request size and content-type pipeline stage for tower stacks.

request_logging

The request-logging pipeline stage: the reference engine’s fourth check, which never blocks.

responses

The reference custom-error and block-hook surfaces (guard_core/core/responses/factory.py and guard_core/_utils/block_events.py).

route_gates

The route-decorator gates for tower stacks: referrer and time window.

semantic

stage_events

The stage event seam: the on_block payload and the SecurityEventBus dispatch the guard stages fire on their blocks, so the observable stream matches spec 12.

sus_patterns

The custom suspicious-pattern registry - the Rust family’s equivalent of the Python engine’s custom-pattern half.

time_window

The route time-window gate: the reference pipeline’s tenth check.

tower

The rate-limit and dynamic-ban pipeline stage for tower stacks: one tower::Layer that Axum, tonic, and any tower::Service consumer install around their inner service.

user_agent

The blocked user-agent pipeline stage for tower stacks.

wiring

The one SecurityConfig to pipeline mapping the adapters share.

Constants

VERSION