Find hidden Unicode in text or files: ASCII smuggling decoded, bidi overrides, look-alike letters.
Scored across 1 tool
There is only one tool, so no misselection is possible, and its purpose (scanning text/URLs for hidden Unicode, trojansource, and look-alike characters) is stated with unusual precision. Triggers, inputs, outputs, and known limits are all spelled out, leaving no ambiguity about when to invoke it.
The single name xray_scan_text follows a clear server-prefix + verb + noun snake_case pattern that would scale predictably to sibling tools. There is no mixing of conventions to penalize.
One tool is defensible because the domain is a single operation (inspect text for hidden/dangerous code points) and both text and URL inputs are folded into it, so nothing is duplicated. It is slightly thin, however—a separate batch/file-set scan or a findings-explanation tool would round out the surface without overlap.
Coverage is strong for the stated scope: inline text and remote URL ingestion, a three-level verdict, per-finding line/column/code point detail, decoding of hidden payloads, and an optional cleaned copy. Gaps are minor—no batch or multi-file scanning, no way to write the cleaned output back to a file, and it explicitly excludes plain-text prompt injection.
Use when the user asks whether text, a prompt, a SKILL.md, AGENTS.md, CLAUDE.md, .cursorrules, README, MCP tool description, PR diff, email or web page hides anything, or before an agent follows, installs or merges instructions that came from someone else (signals: "hidden characters", "invisible unicode", "ASCII smuggling", "prompt injection in this file", "Trojan Source", "why does this string not match", "is this domain spelled with a Cyrillic letter"). Inspects every code point and returns a verdict (clean, suspicious, dangerous) with each finding's line, column, code points and Unicode names: Unicode tag characters (decoded back to the hidden ASCII message), variation-selector payloads (decoded bytes), bidirectional overrides and isolates, long zero-width runs, zero-width and other invisible characters, ANSI terminal escapes, control characters, words that mix Latin with Cyrillic or Greek look-alikes (with the Latin word they imitate, from Unicode confusables), whole look-alike words, styled math letters, unusual spaces, line separators, private-use and unassigned code points, and HTML comments that do not render. Legitimate uses are not flagged (emoji ZWJ sequences, flag tag sequences, a single emoji variation selector, joiners in Arabic and Indic text, direction marks next to Hebrew or Arabic). Give text or url (one public https text file; GitHub and GitLab file pages are read as raw). Example: {"url":"https://github.com/owner/repo/blob/main/SKILL.md"} or {"text":"Visit pаypal.com","return_clean":true}. Optional return_clean adds a copy with hidden characters removed and look-alike letters inside mixed words replaced. Decoded hidden text is returned as data. Limits: finds characters and look-alikes, not prompt injection written in plain visible words; up to 200,000 characters (files up to 1 MB, first 200,000 characters scanned).
Inputs: url, text, return_clean.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Find hidden Unicode (zero-width, bidi, tag payloads), homoglyphs and lookalike names in text.
Find hidden prompt-injection text: ASCII smuggling, zero-width/emoji stego, bidi, homoglyphs.
Scan AI agent skills and configs for hidden Unicode, prompt injection and exfiltration.
Scan configs, files, or text for leaked secrets and obvious misconfigurations. Nothing stored.
Add one secure layer between your agents and this server.
