Inspect both directions
Enable request inspection, response inspection or both for LLM and MCP traffic, with policy configuration for supported targets and principals.
Enterprise DLP
Bring your data policies
into the AI path.
Connect your existing DLP service through ICAP. Apply its inspection decisions to model requests, model responses and MCP traffic.
Enterprise DLP enforcementGoverned
-
01
Resolve policyIdentity, target and inspection scope
-
02
Inspect outbound contentICAP REQMOD
-
03
Inspect returned contentICAP RESPMOD
-
04
Enforce and auditAllow, modified, blocked or error
Identity · Policy · EvidenceWorkflow illustration
Extend the controls you already run
Your DLP decisions.
Enforced by AI Warden.
Fail closed on errors
Enabled ICAP checks deny on inspection errors, timeouts and unsupported responses. Explicit bypasses are recorded with the request.
Keep the decision context
Record DLP decisions, inspection latency, errors and bypass reasons alongside the AI Warden gateway decision.
The inspection boundary
Sensitive content
meets policy first.
Before the model receives a prompt
LLM request-side ICAP inspection runs before prompt compression so the DLP service can inspect the original request content after local scanning.
Before the response reaches the user
Enabled LLM response-side ICAP checks buffer output for inspection, including SSE responses, before returning approved content. This adds latency and changes streaming delivery.
Around MCP tool traffic
Inspect JSON-RPC requests and responses through the MCP Gateway. MCP SSE responses are inspected per complete event.
With trusted identity context
The gateway attaches authenticated request, user, agent and target metadata for the DLP service. Upstream providers do not receive that extra ICAP metadata.
Integration, made concrete
Validate the policy.
Verify the outcome.
Start with one DLP service, one model route and one MCP server. Check allow, modify, block and inspection-error behavior using approved test content.
ICAP is a protocol integration. Vendor-specific policy mappings, network security and deployment behavior should be validated with your actual service.
Plan a DLP integration review-
Connect the inspection service
Configure REQMOD / RESPMOD endpoints and the intended inspection scope.
-
Verify enforcement behavior
Confirm content modification, denial, timeout handling and supported streaming behavior.
-
Review the evidence
Inspect recorded DLP decisions, service latency, errors and any explicit bypasses.
Questions, answered
A clearer path to adoption.
Does AI Warden replace enterprise DLP?
AI Warden can run its own configured content-scanning rules and integrate an external ICAP DLP service. The controls are configured separately and can run together.
Does inspection preserve instant streaming?
LLM ICAP response inspection buffers the response before approved output is delivered. MCP SSE checks inspect complete events. Review latency, size limits and delivery behavior for your use case.
Which DLP vendors are supported?
The integration uses ICAP OPTIONS, REQMOD and RESPMOD. Compatibility and vendor-specific interpretation need to be validated against your service; this website does not claim certification by any DLP vendor.
See AI Warden in action
Put your DLP policy to the test.
Walk through allow, modify, block and fail-closed handling on an AI request path with our engineering team.