The sentinel on
your AI's wire.
pink-crow keeps a live, auditable risk score for every chat and every session — prompt injection, resource exhaustion, data egress — and flags or times out a session when an attack campaign builds. Deterministic. Offline. Apache-2.0.
pip install pink-crow
Attacks don't happen in one message. Your defenses shouldn't reset every turn.
Sessions, not snapshots
A probing attacker tests delimiters, then encodings, then role-play — escalating over many turns. pink-crow keeps a cumulative, time-decayed score that sees the campaign build, not just the last message.
cross-turn scoringThe neglected risk: cost
Resource exhaustion — token floods, "repeat forever", denial-of-wallet — is the single most-ignored OWASP category in guardrail tooling. pink-crow scores LLM06 as a first-class signal.
LLM06 unbounded consumptionExplainable to a security team
"An ML model said 0.83" isn't defensible in an incident review. Every point of a pink-crow score is deterministic, offline, and replayable — the same input always yields the same verdict.
auditable by designScore every message. Act on the session.
Inspect
Deterministic detectors scan each input & output — injection, obfuscation, floods, secret egress.
Map
Every finding carries its OWASP 2026 & 2025 ID. No guesswork, no black box.
Accumulate
Per-event scores roll into a session score that decays over time — a live risk picture.
Decide
A policy maps the score to allow · flag · redact · block · session time-out.
Emit
A risk header on every message, plus an Agent Control Standard disposition.
Honest numbers from the bundled corpus.
These describe the bundled labeled corpus only — a curated set of known shapes, not a claim about novel attacks or real traffic. pink-crow is defense-in-depth, not prevention. Read the honest limits.
Three lines, any stack.
Use the in-process SDK, mount the ASGI middleware, run the language-agnostic HTTP gateway, or gate prompts in CI with the GitHub Action. Same engine, same scores.
Put a sentinel on the wire.
Open source, Apache-2.0, and honest about what it can and can't do.