Tlacuilo

guard_injection

guard_injection

Read-only

Prompt-injection detector for text an agent is about to feed to a model: tool results, scraped pages or user input. Rules and heuristics only, no LLM, fast and deterministic. Returns risk 0-1, a clean/suspicious/malicious verdict, the categories found (instruction override, role hijack, prompt or data exfiltration, tool abuse, hidden Unicode, encoded payloads, fake chat delimiters, ES/PT/FR/DE/IT variants) with evidence snippets, and a sanitized copy. POST with JSON {text, context} also works. Price: $0.002 USDC per call (x402).

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "text": "<text>"
    },
    "name": "guard_injection"
  }
}

Input Schema

Name	Required	Description	Default
`text`	Yes	Text to inspect, up to 200 KB
`context`	No	Where the text comes from: tool_output, user_input (default) or web_page

Schema Changelog

Changes observed during successful MCP inspections.

First observedNov 15, 2026

TDQS

A4.4/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

readOnlyHint=true is consistent with a pure inspection tool, and the description adds substantial context beyond the annotation: deterministic rule-based detection with no LLM, the scoring/verdict/category/evidence/sanitized-copy outputs, an alternate POST JSON invocation, and an explicit per-call price of $0.002 USDC via x402. Cost and payment requirements are exactly the kind of operational detail annotations never carry.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose and method are front-loaded in the first two sentences, and the long category enumeration is packed efficiently into a single clause. The category list is somewhat dense and could be trimmed, but every element carries information an agent needs to interpret the verdict output.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With only two parameters and no output schema, the description fully compensates by describing the return payload field-by-field (risk score, verdict, categories with evidence snippets, sanitized copy). Pricing, determinism, size limit and the alternate POST transport round out everything needed to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both parameters (text with the 200 KB limit, context with its enumerated source values) are already documented in the schema. The description only restates the input sources and the {text, context} body shape, adding no new per-parameter semantics, which is the baseline case for full schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource: a prompt-injection detector for text about to be fed to a model, with concrete input sources (tool results, scraped pages, user input). It also distinguishes its method from an LLM-based alternative ('rules and heuristics only, no LLM'), so an agent knows exactly what class of tool this is without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description makes the triggering situation clear ('text an agent is about to feed to a model: tool results, scraped pages or user input'), which is strong implicit when-to-use guidance. It does not state exclusions or name alternative tools, so it falls short of a full 5, but nothing misleads.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Tlacuilo tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?