Hallucination Firewall
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| HFW_DOTENV | No | Extra .env file to load. | |
| HFW_LEDGER | No | Evidence ledger path shared by the server and the Claude Code hook. | .hfw/ledger.jsonl |
| HFW_LLM_MODEL | No | Model for claim extraction and the tier-2 judge. Defaults to claude-haiku-4-5 or openai/gpt-oss-20b depending on provider. | |
| HFW_NLI_MODEL | No | Any Hugging Face NLI classifier; cross-encoder/nli-deberta-v3-xsmall is about 3x faster. | MoritzLaurer/DeBERTa-v3-base-mnli-fever-anli |
| HFW_EMBED_MODEL | No | Embedding model. Empty string means BM25 only. | BAAI/bge-small-en-v1.5 |
| HFW_LLM_BASE_URL | No | LLM base URL, e.g. http://localhost:11434/v1 for Ollama. Defaults to the provider default. | |
| HFW_LLM_PROVIDER | No | LLM provider: anthropic, groq, openai (any OpenAI-compatible endpoint), or none. auto picks Anthropic if ANTHROPIC_API_KEY is set, then Groq. | auto |
| HFW_PROXY_CONFIG | No | Downstream servers JSON config (same as --proxy). |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
Hallucination Firewall checks your final answer against the tool outputs you actually received in this session.
REQUIRED WORKFLOW for any answer that states facts taken from tool results:
Gather evidence with your tools as usual. Tool outputs are recorded automatically (proxied tools, or the Claude Code hook). If a fact came from somewhere that was not recorded, call record_evidence with the source text first.
Write your draft answer, then call verify_answer(draft) BEFORE replying to the user.
If the result says blocked, do not send the draft. Fix every claim marked contradicted (use the correction / evidence given) and remove or hedge unsupported ones, or call rewrite_grounded(draft). Then verify again.
In your reply, mention when the firewall corrected something. The firewall only checks claims against tool evidence, not against world knowledge.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| verify_answerA | Check every factual claim in a draft answer against recorded tool outputs. Call this before giving the user any answer based on tool results. Returns a verdict per claim (supported / contradicted / unsupported / not_checkable), the evidence behind it, a correction for wrong figures, and whether the draft is blocked. Args: draft: the full answer you intend to send. strictness: optional one-off override: lenient | balanced | strict. action: optional one-off override: annotate | block | rewrite. |
| verify_claimB | Check one standalone factual claim against recorded tool outputs. |
| explain_verdictA | Show the full evidence passages and what each tier decided for a claim id (e.g. "r1.c2"). |
| rewrite_groundedA | Return a corrected version of the draft: wrong figures replaced with the evidence values, unsupported claims hedged (or removed with unsupported="remove"), and citations to the tool outputs added. |
| set_policyB | Configure the firewall. Args: strictness: lenient | balanced | strict (presets for block_on and thresholds). tiers: which verifier tiers may run: 0 exact, 1 NLI model, 2 LLM judge. block_on: verdicts that block the answer, e.g. ["contradicted", "unsupported"]. action: what to do with a flagged answer: annotate | block | rewrite. threshold: tier-1 confidence (0.5-1.0) needed to decide without the LLM judge. |
| record_evidenceA | Add evidence by hand (e.g. text from a tool that is not proxied or hooked). Use the exact text the source returned, never your own summary. |
| reset_sessionA | Clear the evidence ledger and verdict history (start of a new task). |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
| ledger_resource | Everything the tools returned this session. |
| report_resource | Hallucination report for this session. |
TDQS
Scored across 7 tools
Each tool targets a distinct step in the verify workflow: policy setup, evidence capture, single-claim check, whole-answer check, verdict inspection, and rewriting. The only mild overlap is verify_claim vs verify_answer, though the descriptions clearly distinguish one claim from every claim in a draft.
All seven tools follow a clean snake_case verb_noun pattern (verify_claim, set_policy, record_evidence, reset_session, verify_answer, explain_verdict, rewrite_grounded). No mixing of conventions.
Seven tools is well-scoped for a claim-verification firewall, with each tool covering a necessary stage of the workflow. Nothing feels padded or redundant.
The surface covers the full lifecycle: configure policy, record evidence, verify (single and bulk), explain verdicts, rewrite, and reset. Minor gaps exist in that there is no read-back of the current policy or a way to list/inspect recorded evidence, but core workflows are fully served.