Getting Started

Note

Dynamic plugins require dynamic builds of DeepIntShield which are not enabled by default to keep DeepIntShield setup easier. If you want to build and try custom plugins on OSS read building dynamically linked DeepIntShield binary

What are DeepIntShield Plugins?

DeepIntShield plugins allow you to extend the gateway’s functionality by intercepting requests and responses. Plugins can modify, log, validate, or enrich data as it flows through the system, giving you powerful hooks into DeepIntShield’s request lifecycle.

Use Cases

Custom plugins enable you to:

• Transform requests and responses - Modify data before it reaches providers or after it returns
• Add custom validation - Enforce business rules on incoming requests
• Implement custom caching - Cache responses based on custom logic
• Integrate with external systems - Send data to logging, monitoring, or analytics platforms
• Apply custom transformations - Parse, filter, or enrich LLM responses

Plugin Architecture

DeepIntShield leverages Go’s native plugin system to enable dynamic extensibility. Plugins are built as shared object files (.so files) that are loaded at runtime by the DeepIntShield gateway.

How Go Plugins Work

Go plugins use the plugin package from the standard library, which allows Go programs to dynamically load code at runtime. Here’s what makes this approach powerful:

• Native Go Integration - Plugins are written in Go and have full access to DeepIntShield’s type system and interfaces
• Dynamic Loading - Plugins can be loaded, unloaded, and reloaded without restarting DeepIntShield
• Type Safety - Go’s type system ensures plugin methods match expected signatures
• Performance - No IPC overhead; plugins run in the same process as DeepIntShield

Building Shared Objects

Plugins must be compiled as shared objects using Go’s -buildmode=plugin flag:

go build -buildmode=plugin -o myplugin.so main.go

This generates a .so file that exports specific functions matching DeepIntShield’s plugin interface:

v1.4.x+

• Init(config any) error - Initialize the plugin with configuration
• GetName() string - Return the plugin name
• HTTPTransportPreHook() - Intercept HTTP requests before they enter DeepIntShield core (HTTP transport only)
• HTTPTransportPostHook() - Intercept HTTP responses after they exit DeepIntShield core (HTTP transport only)
• PreLLMHook() - Intercept requests before they reach providers
• PostLLMHook() - Process responses after provider calls
• Cleanup() error - Clean up resources on shutdown

v1.3.x

• Init(config any) error - Initialize the plugin with configuration
• GetName() string - Return the plugin name
• TransportInterceptor() - Modify raw HTTP headers/body (HTTP transport only)
• PreLLMHook() - Intercept requests before they reach providers
• PostLLMHook() - Process responses after provider calls
• Cleanup() error - Clean up resources on shutdown

Platform Requirements

Important Limitations:

• Supported Platforms: Linux and macOS (Darwin) only
• No Cross-Compilation: Plugins must be built on the target platform
• Architecture Matching: Plugin and DeepIntShield must use the same architecture (amd64, arm64)
• Go Version Compatibility: Plugin must be built with the same Go version as DeepIntShield

This means if you’re running DeepIntShield on Linux AMD64, you must build your plugin on Linux AMD64 with the same Go version.

Plugin Lifecycle

1. Load - DeepIntShield loads the .so file using Go’s plugin.Open()
2. Initialize - Calls Init() with configuration from config.json
3. Hook Execution - Calls PreLLMHook() and PostLLMHook() for each request
4. Cleanup - Calls Cleanup() when DeepIntShield shuts down

Plugins execute in a specific order:

v1.4.x+

1. HTTPTransportPreHook - Intercept HTTP requests (HTTP transport only)
2. PreLLMHook/PreMCPHook - Executes in registration order, can short-circuit requests
3. Provider call (if not short-circuited)
4. PostLLMHook/PostMCPHook - Executes in reverse order of PreHooks
5. HTTPTransportPostHook - Intercept HTTP responses (HTTP transport only, reverse order)

v1.3.x

1. TransportInterceptor - Modifies raw HTTP requests (HTTP transport only)
2. PreHook - Executes in registration order, can short-circuit requests
3. Provider call (if not short-circuited)
4. PostHook - Executes in reverse order of PreHooks

Next Steps

Ready to build your first plugin? Choose your approach:

• Writing Go Plugins - Native Go plugins using shared objects (.so files). Best for performance and full Go ecosystem access.
• Writing WASM Plugins - Cross-platform plugins using WebAssembly. Write in TypeScript, Go (TinyGo), or Rust. No version matching required.