feat: add Qohash Nexus guardrail hook

[mats852]

Relevant issues

N/A: New integration for Qohash Qostodian Nexus guardrail.

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have Added testing in the tests/test_litellm/ directory, Adding at least 1 test is a hard requirement - see details
• My PR passes all unit tests on make test-unit
• My PR's scope is as isolated as possible, it only solves 1 specific problem
• I have requested a Greptile review by commenting @greptileai and received a Confidence Score of at least 4/5 before requesting a maintainer review

Delays in PR merge?

If you're seeing a delay in your PR being merged, ping the LiteLLM Team on Slack (#pr-review).

CI (LiteLLM team)

CI status guideline:

• 50-55 passing tests: main is stable with minor issues.
• 45-49 passing tests: acceptable but needs attention
• <= 40 passing tests: unstable; be careful with your merges and assess the risk.

• Branch creation CI run
  Link:

• CI run for the last commit
  Link:

• Merge / cherry-pick CI run
  Links:

Type

🆕 New Feature
🐛 Bug Fix
🧹 Refactoring
📖 Documentation
🚄 Infrastructure
✅ Test

Changes

Add Qohash Qostodian Nexus as a guardrail integration for LiteLLM proxy.

• Guardrail hook (litellm/proxy/guardrails/guardrail_hooks/qohash/): QostodianNexus class extending GenericGuardrailAPI with built-in x-qostodian-nexus-identifiers-* extra headers and configurable api_base (defaults to
  http://nexus:8800, overridable via QOSTODIAN_NEXUS_API_BASE env var).
• Config model (litellm/types/proxy/guardrails/guardrail_hooks/qohash.py): QostodianNexusConfigModel with api_base field.
• Registry: Added QOSTODIAN_NEXUS to SupportedGuardrailIntegrations enum, guardrail initializer registry, and class registry.
• Documentation (docs/my-website/docs/proxy/guardrails/qohash_qostodian_nexus.md): Usage guide with YAML config examples.
  • UI: Added Qohash logo and sidebar entry.
  • Tests (tests/test_litellm/proxy/guardrails/test_qostodian_nexus_guardrail.py): 17 unit tests covering initialization, registry, config model, env vars, unified detection, and extra header merging.

[CLAassistant]

All committers have signed the CLA.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
litellm	Ready	Preview, Comment	Apr 1, 2026 5:35pm

[mats852]

@greptile 🤠

[codspeed-hq]

Merging this PR will not alter performance

✅ 16 untouched benchmarks

---

_{Comparing qohash:litellm-qohash-qostodian-nexus-guardrail (9f6cc6f) with main (c987bdb)}

[greptile-apps]

Greptile Summary

This PR adds a new Qohash Qostodian Nexus guardrail integration to LiteLLM, following the established GenericGuardrailAPI extension pattern used by other recent hooks (GraySwan, etc.). The implementation is clean and well-scoped.

Key changes:

• QostodianNexus extends GenericGuardrailAPI, automatically picking up all request/response scanning, fail-closed behaviour, and the unified-guardrail routing path
• Built-in x-qostodian-nexus-identifiers-* headers are merged with any caller-supplied extra_headers at construction time; deduplication is handled correctly
• The apply_guardrail override is required so that "apply_guardrail" in type(callback).__dict__ evaluates to True in the unified-routing check in proxy/utils.py
• The guardrail_initializer_registry / guardrail_class_registry dicts follow the dynamic-discovery contract in guardrail_registry.py, so no changes to the central registry file are needed
• QostodianNexusConfigModel.ui_friendly_name() returns "Qostodian Nexus", matching the guardrailLogoMap key added in guardrail_info_helpers.tsx (previously reported mismatch is resolved)
• All 17 unit tests use mocks; no real network calls are made, satisfying the CI/mock-only rule for the tests/test_litellm/ directory
• Documentation covers all four decision outcomes (ALLOW / LOG / REDACT / BLOCK), identifier headers, and security guidance (TLS, mTLS)

Confidence Score: 5/5

Safe to merge — no P0/P1 issues remain; all previously flagged concerns have been resolved.

All prior review findings (logo key mismatch, unused imports) are addressed. The integration follows established patterns, tests are fully mocked, and the dynamic registry discovery will pick up the new hook without touching the central registry file. No backwards-incompatible changes introduced.

No files require special attention.

Important Files Changed

Filename	Overview
litellm/proxy/guardrails/guardrail_hooks/qohash/qohash.py	Core integration class extending GenericGuardrailAPI; correctly merges built-in identifier headers with caller-supplied headers, and overrides apply_guardrail to satisfy the unified-detection check in proxy/utils.py.
litellm/proxy/guardrails/guardrail_hooks/qohash/init.py	Initializer factory and registry dicts; follows the dynamic-discovery contract so guardrail_registry.py picks them up automatically. Missing unreachable_fallback forwarding compared to the generic hook, but fail_closed is a safe default for a security product.
litellm/types/proxy/guardrails/guardrail_hooks/qohash.py	Minimal config model adding api_base field; ui_friendly_name() returns "Qostodian Nexus" matching the guardrailLogoMap key after the logo-mismatch fix.
litellm/types/guardrails.py	QOSTODIAN_NEXUS added to SupportedGuardrailIntegrations enum and QostodianNexusConfigModel mixed into LitellmParams; api_base field is compatible with BaseLitellmParams's existing api_base definition.
tests/test_litellm/proxy/guardrails/test_qostodian_nexus_guardrail.py	17 unit tests covering init, registries, config model, env vars, unified-detection logic, and header merging; all tests are properly mocked with no real network calls.
ui/litellm-dashboard/src/components/guardrails/guardrail_info_helpers.tsx	Added QostodianNexus to guardrail_provider_map and guardrailLogoMap with key "Qostodian Nexus" matching ui_friendly_name(); previously reported logo mismatch is now resolved.
docs/my-website/docs/proxy/guardrails/qohash_qostodian_nexus.md	Comprehensive docs covering quick-start, all four decision types with curl examples, identifier headers, security guidance, and deployment modes.

_{Reviews (2): Last reviewed commit: "Update litellm/proxy/guardrails/guardrai..." | Re-trigger Greptile}

[greptile-apps]

Logo will never display — display name mismatch

The guardrailLogoMap key "Qohash Qostodian Nexus" does not match the value returned by QostodianNexusConfigModel.ui_friendly_name(), which is "Qostodian Nexus".

The UI logo-lookup path (used in both add_guardrail_form.tsx and edit_guardrail_form.tsx) is:

1. populateGuardrailProviders populates DynamicGuardrailProviders["QostodianNexus"] = ui_friendly_name → "Qostodian Nexus"
2. getGuardrailLogoAndName does logo = guardrailLogoMap[displayName] → guardrailLogoMap["Qostodian Nexus"] → undefined

So the logo is silently dropped. Either the guardrailLogoMap key must match ui_friendly_name() exactly, or the Python method must be changed to match.

Suggested change

	"Qohash Qostodian Nexus": `${asset_logos_folder}qohash.jpg`,
	"Qostodian Nexus": `${asset_logos_folder}qohash.jpg`,

[mats852]

done @greptile

[greptile-apps]

Perfect! Confirmed. The logo map key now matches ui_friendly_name():

• Python: ui_friendly_name() returns "Qostodian Nexus"
• TypeScript: guardrailLogoMap["Qostodian Nexus"] now exists

The logo will display correctly in the UI.

[codecov]

Codecov Report

❌ Patch coverage is 97.43590% with 1 line in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
.../proxy/guardrails/guardrail_hooks/qohash/qohash.py	94.73%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!