Skip to main content
Glama

TunnelMind Data API

scan_injection

Runs a curated signature corpus over a piece of untrusted text — content an agent is about to consume, a retrieved document, a tool result, an email body — and returns the matched injection patterns plus a bounded 0..1 risk score. This is a signal, never a policy decision: the caller decides what to do with a flagged input.

Detected classes: instruction_override (ignore/override previous rules), role_reassignment (you are now DAN / developer mode), exfiltration (leak the system prompt or a secret to a URL), tool_smuggling (covertly invoke a tool, delete/destroy data), boundary_spoof (fake system/assistant turn delimiters). Input is normalized first to blunt cheap evasions (zero-width characters, smart quotes, whitespace padding).

Use this tool when:

  • You are an agent about to feed retrieved or third-party text into a model and want to check it for embedded instructions first.

  • You are triaging why a tool description or web page looks suspicious.

Do NOT use this tool when:

  • You want a trust verdict on a domain or entity — use cross_lens_verify.

  • You want to scan a whole MCP server's tools — use scan_mcp.

Inputs:

  • text (body, required): the untrusted text to scan. Max 200,000 chars.

Returns:

  • flagged: true if any signature matched.

  • score: bounded 0..1 risk score (saturating — one high-severity hit is already strongly flagged; many hits approach but never exceed 1).

  • severity_max: highest severity among matches (high/medium/low) or null.

  • classes: distinct injection classes matched.

  • matches: each matched signature { id, class, severity, excerpt }.

Cost:

  • Free. No API key required. Pure edge computation, no external calls.

Latency:

  • Typical <20ms.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
textYesUntrusted text to scan for injection signatures.

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full behavioral burden. It discloses input normalization (zero-width chars, smart quotes), saturating risk score, pure edge computation with no external calls, and cost/latency. It also clarifies it is a signal, not a policy decision, providing rich behavior context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but well-structured with clear sections (purpose, classes, use cases, inputs, returns, cost, latency). It front-loads the core purpose in the first sentence and uses bullet-like lists for readability. Every section adds necessary value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having no output schema, the description fully specifies all returned fields (flagged, score, severity_max, classes, matches) and their semantics. It also covers operational context (free, <20ms latency) and limitations, making it complete for an agent to decide and invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although schema covers the text parameter's name and description, the tool description adds significant meaning: examples of untrusted text (retrieved document, email body), max length, normalization details, and what constitutes injection classes. This goes well beyond the schema's minimal 'Untrusted text to scan'.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool scans untrusted text for injection patterns and returns matched signatures plus a risk score. It explicitly distinguishes itself from siblings like cross_lens_verify (trust verdict) and scan_mcp (scan MCP server), making the purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes dedicated 'Use this tool when' and 'Do NOT use this tool when' sections with specific examples and alternatives. This gives explicit guidance on when to use scan_injection versus other tools, which is exemplary.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

B3.3/5.0
Disambiguation2/5

Many tools overlap in purpose, such as cross_lens_verify, cross_lens_lookup, profile_entity, and preflight_should_i_act, which all return node verdicts with subtle differences. Sigil verification tools and receipt-related tools also have similar names and require deep reading to distinguish.

Naming Consistency3/5

The tool names are mostly readable, but the pattern is mixed: some use verb_noun (get_domain, create_subscription) while others use domain prefixes (sigil_*, ghostroute_*, intel_*). Within each domain, naming is consistent, but the overall style lacks uniformity.

Tool Count1/5

With 90 tools, this server is extremely overloaded. Even for a multi-purpose data API, the sheer number overwhelms and makes navigation difficult, far exceeding the typical well-scoped MCP server. The count is an extreme mismatch for the apparent scope.

Completeness4/5

The tool surface is very comprehensive, covering tracker lookup, cross-lens verification, receipts, compliance, subscriptions, tasks, intel probes, and more. Minor gaps exist, such as no batch cross-lens verification, but core workflows are well covered.

Resources