Those are not the same problem. A classifier that scores your prompt cannot stop a subprocess call that your application makes in response to it.
| Capability | Thicket | Cloud prompt scanners |
|---|---|---|
| Blocks at the execution boundary | Yes, before the operation completes | No, returns a score only |
| SSRF protection | Yes | No |
| Code execution prevention | Yes | No |
| Deserialization hardening | Yes | No |
| Works offline / air-gapped | Yes | No |
| Deterministic (no AI making blocking decisions) | Yes | No |
| Data leaves your process | Never | Always |
| OS kernel backstop | Yes (Linux) | No |
| Added latency | In-process, negligible | Network round-trip per call |
For teams with data-sovereignty requirements, a cloud scanner that receives your prompts and model outputs is not a viable option regardless of detection quality. Thicket never sends data outside your process.