Skip to main content
Silmaril middleware runs in your application around the gateway model. It inspects calls made through that wrapped model.

Prerequisites

  • Install and configure the TypeScript SDK.
  • Set AI_GATEWAY_API_KEY for your Vercel AI Gateway account, or use Vercel’s supported deployment authentication.
  • Set SILMARIL_API_KEY and SILMARIL_API_URL to your provisioned Silmaril classify credentials.

Install the AI SDK

Wrap the gateway model

Use a model available to your gateway account. The example starts in shadow mode, so would-block decisions do not interrupt model calls. From TypeScript SDK 0.10.0 the middleware classifies generated text by default, so one wrapped model covers input and output.

Verify and enforce

Confirm both input and output classifications appear in Silmaril. The middleware checks input before the model call and generated text before it is returned. When ready to enforce, set mode to "block" and handle FirewallBlockedException before returning a response to the caller. See TypeScript error handling. Handle gateway authentication, model, and network errors separately. A failed request is not a benign verdict.

Coverage

This example protects non-streamed generated text. On TypeScript SDK versions before 0.10.0, pass scanOutput: false, classify response.text explicitly, and stop on a blocking verdict before returning it, as shown in the Vercel AI SDK guide. Set scanToolCalls: true to classify generated tool-call arguments. With AI SDK 6 streaming, output is classified after delivery, so use non-streaming generation or the AI SDK 7 adapter when blocking before delivery is required. Pass parallel: true to start the model call while its input is classified. Every protected call must use the wrapped model. Configuring middleware in one application does not enable a gateway-wide guardrail for other applications or unwrapped calls.

Next steps

Verify your integration, then review modes and enforcement.