All projects matching “prompt-injection”

A2A Indirect Prompt-Injection & Jailbreak Firewall (/v1/prompt-guard) — Scans untrusted web pages, emails, MCP responses, or A2A payloads for hidden prompt injections and returns sanitized text. (https://prompt-guard.agentdiet.dev/v1/prompt-guard)

A2A Indirect Prompt-Injection & Jailbreak Firewall (/v1/prompt-guard) — Scans untrusted web pages, emails, MCP responses, or A2A payloads for hidden prompt injections and returns sanitized text. (https://mcp-security.agentdiet.dev/v1/prompt-guard)

Safe Read: read a webpage (URL to clean text) with a prompt injection scan. Fetch one public web page and get its clean main text, title, metadata, a sha256 content hash, and prompt-injection warnings with a 0-100 risk score (visible text, hidden elements, HTML comments, alt/meta attributes, invisible Unicode, base64). SSRF-guarded: DNS-checked and pinned public addresses only, 4 redirects max, 2

Statically analyse a Model Context Protocol (MCP) server manifest for security risks. Tool descriptions enter the model context, a prime prompt-injection vector. Deterministic and offline (inline manifest). Flags dangerous capabilities (command/code execution, filesystem, credential and network access), injection patterns, hidden unicode and unconstrained parameters. Returns severity-ranked findin

Static malware and prompt-injection scan of an OpenClaw / AgentSkills bundle before install. Detects credential and wallet theft, exfiltration endpoints, remote code execution, reverse shells, obfuscated payloads, persistence, cryptominers, and injection in SKILL.md. Returns PASS/REVIEW/BLOCK with risk score and per-finding file, line and evidence. bundle = {files:[{path,content}]} or {github:'own

Prompt-injection scan for text your AI agent is about to read (web pages, emails, tool output, MCP tool descriptions): risk score 0-100, verdict, categories and exact spans. Detects instruction overrides, jailbreak personas, system-prompt extraction, fake chat delimiters, data-exfiltration URLs, tool hijacking, hidden Unicode and encoded payloads. Deterministic rules, no data stored.

Web page to markdown (read URL as clean text) for LLM agents: main content only (no nav, cookie banners, ads), with title, description, author, dates, language, headings, internal/external links and JSON-LD types, PLUS a prompt-injection scan of the page (visible text, hidden HTML, comments, invisible Unicode) so your agent knows whether the content tries to give it orders. Fetched from Cloudflare

Prompt-injection screen for text or a web page an agent is about to read: finds instruction overrides (many languages and obfuscated spellings), fake system or role markers, jailbreak personas, data-exfiltration links, requests for keys or seed phrases, tool, shell, or payment hijacks, and hidden content (invisible Unicode smuggling, zero-width and bidi characters, HTML comments, hidden elements,

Free tier: 25 calls/day per IP with header X-Free-Call: 1 (or ?free=1), then pay per call. Rule-based prompt-injection screen for untrusted text such as scraped web pages, emails and tool output. JSON body {text} (max 50,000 chars). Detects instruction-override phrasing, role-spoofing tags, data-leak links and hidden Unicode in 6 languages. Returns verdict safe, suspicious or malicious, a 0-100 sc

Deterministic prompt-injection firewall and honeypot scrubber for AI agents. Sanitizes untrusted text and blocks detected wallet-draining commands before context ingestion.

Prompt-injection scanner for content your agent is about to read. Returns a risk score (0-1), a level (low/medium/high), findings and the cleaned text wrapped as untrusted data (hidden text, invisible characters, data-exfiltration links, instruction-override phrases in 13 languages). Deterministic. Content is scanned in memory and never stored. Not charged if it fails. Also: /v1/read $0.005, /v1/s

DCL Trust Oracle. Call only when the text must include the substring AI and must not include "I cannot be held responsible" or "no guarantees". POST JSON {"response","agent_id"}. COMMIT means those checks passed and the action may proceed. NO_COMMIT means do not execute the checked action. Not a tool-call guardrail, prompt-injection detector, or jailbreak screen; use /evaluate/fast for the phrase

Pre-payment check of an x402 API endpoint: discovery files, live 402 terms, comparable USDC prices, latency, prompt-injection flags and public Coinbase CDP Bazaar payment statistics for the host. Heuristic, not a guarantee. $0.002; unreachable targets are free. Online shops: pre_purchase_merchant_trust_check.

Fetch a public URL with SSRF protection, clean extraction, and semantic prompt-injection analysis.

POST a URL; get clean, LLM-ready content (Markdown/text/JSON) plus a prompt-injection risk verdict (clean | suspicious | flagged). A defense layer for agents and RAG pipelines, not a guarantee.

Preflight untrusted text for common prompt-injection, credential-exfiltration, and tool-abuse patterns. Deterministic heuristic scan; not a guarantee of safety.

Scan text or a URL for prompt-injection risk and return a risk score.

MCP security: catch a rug pull or tool poisoning between two tools/list results of the same MCP server — the version you approved and the one it serves now. Flags instructions aimed at the model, override and concealment wording, credential and wallet paths, covert actions, hidden Unicode, new URLs and addresses, a dropped readOnlyHint, new command or path parameters and look-alike tool names; ver

For model cascades: is the small model's answer usable, or should the larger model be paid? Detects refusal, evasion, off-topic answers, contradiction and incompleteness; decides accept, review or escalate. Does not fact-check without a source: provide the source to check substance.

Fact-check one claim against live web sources (or URLs you supply). Returns a verdict (supported, refuted, mixed, insufficient), a confidence score and supporting or contradicting quotes that are checked verbatim against the fetched pages. Use it before an agent repeats a claim.

Payment-Injection Screen by Agentropolis: send text your agent is about to act on (tool result, web page, email, file). Flags payment-looking instructions: pay/transfer requests, fake licence or refundable fees, swapped wallets, token approvals, seed-phrase asks, hidden text. Returns clean/caution/likely_payment_injection with evidence. Advisory only.

Turn any page into readable text: clean markdown plus the sha256 of the extracted content, so an agent can read a link without a browser.

Transfer logs for one token contract, optional holder filter, amounts decoded with token decimals, read-only.