{"record":{"id":"c4b4c96be749a1e6","repo":"BerriAI/litellm","slug":"missing-llm-guard-api-base-from-environment","errorCode":null,"errorMessage":"Missing `LLM_GUARD_API_BASE` from environment","messagePattern":"Missing `LLM_GUARD_API_BASE` from environment","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"enterprise/litellm_enterprise/enterprise_callbacks/llm_guard.py","lineNumber":37,"sourceCode":"from litellm.proxy._types import UserAPIKeyAuth\nfrom litellm.secret_managers.main import get_secret_str\nfrom litellm.types.utils import CallTypesLiteral\n\n\nclass _ENTERPRISE_LLMGuard(CustomLogger):\n    # Class variables or attributes\n    def __init__(\n        self,\n        mock_testing: bool = False,\n        mock_redacted_text: Optional[dict] = None,\n    ):\n        self.mock_redacted_text = mock_redacted_text\n        self.llm_guard_mode = litellm.llm_guard_mode\n        if mock_testing is True:  # for testing purposes only\n            return\n        self.llm_guard_api_base = get_secret_str(\"LLM_GUARD_API_BASE\", None)\n        if self.llm_guard_api_base is None:\n            raise Exception(\"Missing `LLM_GUARD_API_BASE` from environment\")\n        elif not self.llm_guard_api_base.endswith(\"/\"):\n            self.llm_guard_api_base += \"/\"\n\n    def print_verbose(self, print_statement):\n        try:\n            verbose_proxy_logger.debug(print_statement)\n            if litellm.set_verbose:\n                print(print_statement)  # noqa\n        except Exception:\n            pass\n\n    async def moderation_check(self, text: str) -> str:\n        \"\"\"\n        Runs the LLM Guard moderation check on ``text``.\n\n        Raises an HTTPException when the content violates the safety policy;\n        otherwise returns the sanitized prompt from LLM Guard, falling back to\n        the original text when the API does not provide one.","sourceCodeStart":19,"sourceCodeEnd":55,"githubUrl":"https://github.com/BerriAI/litellm/blob/6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d/enterprise/litellm_enterprise/enterprise_callbacks/llm_guard.py#L19-L55","documentation":"Exception raised in the LLM Guard hook's __init__ when the environment variable LLM_GUARD_API_BASE is not set (looked up via get_secret_str). The hook needs a running LLM Guard service (protectai's llm-guard API wrapper) to sanitize prompts, so it refuses to initialize without its base URL.","triggerScenarios":"Adding the llm_guard hook/callback to the proxy config without exporting LLM_GUARD_API_BASE in the proxy process's environment. mock_testing=True skips the check, so it only fires in real deployments.","commonSituations":"Enabling LLM Guard integration after reading enterprise docs but forgetting the env var; env var set in a shell but not in the systemd unit/Docker Compose/Kubernetes deployment where the proxy actually runs; secret managers not wired so get_secret_str finds nothing.","solutions":["Set LLM_GUARD_API_BASE to your LLM Guard service URL (e.g. http://llm-guard:8000/) in the proxy's environment — include the trailing slash or not, the hook normalizes it.","For Kubernetes, add it to the deployment env/envFrom instead of relying on local shell exports.","Verify with a direct request: curl $LLM_GUARD_API_BASE/analyze/prompt -d '{\"prompt\":\"hi\"}'.","If just testing hook wiring, init with mock_testing=True."],"exampleFix":"# before\ncallbacks: llm_guard  # LLM_GUARD_API_BASE unset -> Exception\n\n# after\nexport LLM_GUARD_API_BASE=http://llm-guard.internal:8000/\ncallbacks: llm_guard","handlingStrategy":"validation","validationCode":"import os\n\napi_base = os.getenv(\"LLM_GUARD_API_BASE\")\nif not api_base:\n    raise SystemExit(\"LLM_GUARD_API_BASE must be set before enabling llm_guard\")","typeGuard":null,"tryCatchPattern":"try:\n    hook = _ENTERPRISE_LLMGuard()\nexcept Exception as e:\n    if \"LLM_GUARD_API_BASE\" in str(e):\n        logger.error(\"export LLM_GUARD_API_BASE=http://llm-guard:8000/ and restart\")\n    raise","preventionTips":["Set LLM_GUARD_API_BASE in the deployment spec (K8s env, Compose environment), not just local shell.","Use mock_testing=True in CI to exercise hook wiring without the service.","Add a readiness probe against the LLM Guard service before enabling the hook.","Keep the URL scheme+host stable across environments via config maps."],"tags":["enterprise","llm-guard","environment","config","startup"],"backgroundTag":null,"analyzedSha":"6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d","analyzedAt":"2026-08-15T07:12:03.035Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}