Agent safety checks: prompt-injection scan, honeypot check, x402 preflight + crypto data (USDC/x402)

Prompt-injection scan for untrusted web, email and tool content

input_guard

Read-only

Prompt-injection and hidden-instruction scan for untrusted input before an agent acts on it: web pages, emails, RAG chunks, tool and MCP responses. Flags text aimed at the model (role takeover, forged system or tool turns, requests for keys, the prompt, history or payments, exfiltration links), invisible Unicode (tag smuggling decoded, zero-width, bidi), homoglyphs, base64 payloads and HTML hidden from humans, in 17 languages. Verdict clean, caution or hostile, score, findings, cleaned text. 0.99 USDC base (new payers 0.99, >10 payments 0.693; 20 pack calls). After: preflight before your agent pays anything the content pointed to (the result's next field has the exact call).

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "input_guard"
  }
}

Input Schema

Name	Required	Description
`url`	No	a public https page to fetch once and check (256 KB)
`text`	No	the content to check (send text or url)
`payment_tx`	No	Hash of a USDC transfer on Base to payTo (≥ the price, ≤ 72 h old) instead of an x402 signature.
`bundle_token`	No	Token from buy_signal_pack, buy_subscription (pro/desk) or buy_enterprise instead of paying per call.
`payer_address`	No	Wallet you pay from: the payment-required error quotes your tier (0 payments base price (new-payer surcharge paused), 1-10 base, >10 -30 %) and, from the third payment, an upgrade with your own spend.

Schema Changelog

Changes observed during successful MCP inspections.

AddedNov 13, 2026

TDQS

A4.6/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already establish a safe read operation and open-world scope, and the description adds substantial behavior beyond them: detection categories, invisible Unicode decoding, 17-language coverage, verdict levels, findings, cleaned text, and payment tier behavior. It also discloses the pricing model and pack-call option, which an agent needs before invoking a paid scan.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The definition is front-loaded with the scan purpose and detection scope, then moves to outputs and payment details without idle filler. It is dense, especially the pricing parentheticals, but each part carries relevant operational information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex paid scanning tool with no output schema, the description covers purpose, input scope, detection behavior, verdict fields, cleaned text, and payment alternatives. It also gives the immediate next step via preflight, leaving little an agent needs before calling it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the parameters are already documented. The description still adds useful meaning by explaining the 0.99 USDC base price, new-payer and high-volume tiers, and the bundle_token sources, which clarifies the payment parameters beyond their schema text.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: a prompt-injection and hidden-instruction scan for untrusted input, enumerating web pages, emails, RAG chunks, and tool/MCP responses. It also names the attack classes it targets and the verdicts it returns, so an agent can distinguish this from generic validation or payment tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives clear when-to-use guidance: scan untrusted input before the agent acts on it, and use preflight before paying anything the content points to. It does not explicitly compare against the sibling input_guard_preview or state when not to use this tool, which keeps it below a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Agent safety checks: prompt-injection scan, honeypot check, x402 preflight + crypto data (USDC/x402) tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?