Validate

Validate rejects a payload that doesn't conform to a schema or type, before it reaches an AI agent, an upstream MCP server or HTTP API, or an LLM provider. It's built on two primitives Zilla already uses to govern data everywhere in a config, not something specific to any one AI Gateway binding:

• Schema Registry defines where a schema lives: embedded in zilla.yaml, read from the local filesystem, or fetched from a remote schema registry.
• Schema Enforcement defines the type or schema a payload is checked against, from primitives like string and int32 to schema-backed formats like avro, json, and protobuf.

Every example below checks structure. For free text a schema can't meaningfully constrain, Classify rejects a payload by its content instead, such as a secret, personal data, or a jailbreak attempt detected by meaning.

Validating Tool Call Arguments on mcp proxy

The mcp proxy binding's options.tools field validates tools/call request arguments directly against a primitive model, before the call is routed to an upstream:

options:
  tools: json

See the mcp proxy reference for the full set of supported primitive models.

Validating Tool Arguments and Responses on mcp-http

The mcp-http proxy binding validates both directions of a tool call: schemas.input checks the tools/call arguments before the upstream HTTP request is dispatched, and schemas.output checks the upstream HTTP response before it's surfaced as the tool result. Each is a converter binding a model to a catalog subject:

options:
  tools:
    create_pr:
      schemas:
        input:
          model: json
          catalog:
            my_catalog:
              - subject: create_pr_params
                version: latest
        output:
          model: json
          catalog:
            my_catalog:
              - subject: create_pr_result
                version: latest

A tools/call whose arguments don't conform to the resolved schema is rejected before the upstream request is made; an upstream response that doesn't conform to the output schema is rejected before it reaches the agent. mcp-http resources support the same schemas.output converter on resources/read. See the mcp-http reference for the full shape.

Validating HTTP Traffic Directly

Where a plain http binding fronts or proxies AI Gateway traffic outside of mcp/mcp-http, it accepts a model on request and response content, headers, path, and query parameters, using the same primitive model names:

options:
  requests:
    - path: /tools/call
      method: POST
      content:
        model: json
      responses:
        - status: 200
          content:
            model: json

See the http server and http client reference for the full set of options, including headers, path, and query validation.

Validating LLM Prompts on llm proxy

llm · server already rejects a request that isn't valid JSON in its API's format, with 400 Bad Request, before any configured check runs. See Request Checks.

To check what a prompt contains, the llm · proxy binding's options.guardrails applies a model to one section of the conversation, such as the user's text, for each model callers ask for. A validating model such as string with maxLength limits the size of a section:

options:
  guardrails:
    gpt-4o-mini:
      request:
        - section: user-text
          value:
            model: string
            maxLength: 2000

A prompt for gpt-4o-mini whose user text is longer than 2000 bytes is rejected with 400 Bad Request, in the error format of the caller's API, and is never sent to the provider. See LLM Guardrails for every section you can check, checks on the provider's reply, and the guide that runs this check.

Validating Against a Registered Schema

Wherever Zilla accepts a schema-backed model (avro, json, or protobuf), pairing it with a catalog validates against a schema resolved by subject, topic, or ID, rather than a fixed primitive type. Kafka Gateway's Validate uses exactly this pairing to validate Kafka message keys and values against a schema fetched from a registry, and mcp-http's schemas.input/schemas.output above use the identical model/catalog shape:

value:
  model: avro
  catalog:
    schema_registry:
      - strategy: topic

Next Steps

• Schema Registry covers each catalog type and when to use it.
• Schema Enforcement covers each model type, from primitives to schema-backed formats.
• Classify covers rejecting a payload by its content instead of its structure.
• LLM Guardrails covers every check llm · proxy applies to prompts and replies.
• Transform covers transforming a payload's representation once it's validated.