Zambo

Prompt Shield

prompt_shield

Read-onlyIdempotent

Detection and analysis of prompt injection, jailbreak, and policy-bypass attempts. Returns an injection risk score, a safe/review/block recommendation, attack indicators, and a safe rewritten version when available. AER-1 receipt, verifiable offline. Required arguments: prompt.

Input Schema

Name	Required	Description	Default
`_ref`	No	Optional handover referral ID from your install link.
`mode`	No	'fast' = pattern scan only (default), 'deep' = pattern + Groq semantic analysis
`email`	No	Zambo Pass email for unlimited calls (optional)
`prompt`	Yes	The user input or prompt to validate for injection/jailbreak (max 16K chars)
`system`	No	Your system prompt - also scanned for prompt leak attempts (optional)
`context`	No	Describe your app for better contextual analysis (optional)
`_zambo_key`	No	Optional opaque Zambo access capability. Never place it in a URL or public log.
`_session_id`	No	Optional stable bot-job ID. Reuse it across calls to bind a Day Pass and keep the job ledger together.
`certificate`	No	If true, freeze this scan as a permanent public certificate and return certificate_url (optional)
`_caller_label`	No	Optional caller label recorded as a caller-reported claim in the receipt.	zambo-starter
`_caller_handle`	No	Opaque anonymous continuity handle returned during initialize. Reuse it across MCP sessions; it is not payment authorization.
`_continuity_ai_label`	No	Optional self-reported AI client label for the private continuity timeline. Zambo does not independently verify the client.

Output Schema

Name	Required	Description
`ok`	Yes
`ids`	Yes
`next`	Yes
`tier`	No
`urls`	Yes
`error`	No
`graph`	No
`active`	No
`result`	Yes	The tool's observed JSON value or plain-text result.
`intents`	No
`next_up`	No
`payment`	No
`day_pass`	No
`today_url`	No
`expires_at`	No
`human_line`	Yes
`next_steps`	No
`daily_recap`	No
`renew_nudge`	No
`unlock_link`	No
`seconds_left`	No
`resume_status`	No
`resumed_result`	No

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedNov 5, 2026
- changedOutput schema / properties / human_line / maxLength
```
Previous value: -200New value: +512
```

Changed2 schema fields changedOct 25, 2026

addedInput schema / properties / _caller_handle

Added value: +{
+  "description": "Opaque anonymous continuity handle returned during initialize. Reuse it across MCP sessions; it is not payment authorization.",
+  "maxLength": 64,
+  "type": "string"
+}

addedInput schema / properties / _caller_label / default
```
Added value: +"zambo-starter"
```

Changed1 schema field changedOct 23, 2026
- changedOutput schema / properties / graph / properties / aer / const
```
Previous value: -"draft-zambo-aer1-25"New value: +"draft-zambo-aer1-26"
```
Changed1 schema field changedOct 22, 2026
- changedOutput schema / properties / graph / properties / aer / const
```
Previous value: -"draft-zambo-aer1-24"New value: +"draft-zambo-aer1-25"
```
Changed1 schema field changedOct 20, 2026
- changedOutput schema / properties / graph / properties / aer / const
```
Previous value: -"draft-zambo-aer1-23"New value: +"draft-zambo-aer1-24"
```
Changed1 schema field changedOct 19, 2026
- changedOutput schema / properties / graph / properties / aer / const
```
Previous value: -"draft-zambo-aer1-22"New value: +"draft-zambo-aer1-23"
```
Changed1 schema field changedOct 18, 2026
- changedOutput schema / properties / graph / properties / aer / const
```
Previous value: -"draft-zambo-aer1-21"New value: +"draft-zambo-aer1-22"
```
Changed1 schema field changedOct 18, 2026
- changedOutput schema / properties / graph / properties / aer / const
```
Previous value: -"draft-zambo-aer1-20"New value: +"draft-zambo-aer1-21"
```
Changed1 schema field changedOct 17, 2026
- addedOutput schema / properties / next_steps
```
Added value: +{
+  "items": {},
+  "minItems": 1,
+  "type": "array"
+}
```

Changed12 schema fields changedOct 17, 2026

addedInput schema / properties / _ref

Added value: +{
+  "description": "Optional handover referral ID from your install link.",
+  "format": "uuid",
+  "type": "string"
+}

changedOutput schema / additionalProperties
```
Previous value: -falseNew value: +true
```

addedOutput schema / properties / error

Added value: +{
+  "additionalProperties": true,
+  "anyOf": [
+    {
+      "required": [
+        "next_call"
+      ]
+    },
+    {
+      "required": [
+        "next_url"
+      ]
+    }
+  ],
+  "properties": {
+    "code": {
+      "type": "string"
+    },
+    "next_call": {
+      "additionalProperties": false,
+      "properties": {
+        "args": {
+          "type": "object"
+        },
+        "tool": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "tool",
+        "args"
+      ],
+      "type": "object"
+    },
+    "next_step": {
+      "type": "string"
+    },
+    "next_url": {
+      "type": "string"
+    }
+  },
+  "required": [
+    "code",
+    "next_step"
+  ],
+  "type": "object"
+}

addedOutput schema / properties / graph

Added value: +{
+  "properties": {
+    "aer": {
+      "const": "draft-zambo-aer1-20"
+    },
+    "schema": {
+      "const": "zambo.graph/1"
+    }
+  },
+  "required": [
+    "schema",
+    "aer",
+    "nodes",
+    "edges",
+    "retries",
+    "sources",
+    "summary"
+  ],
+  "type": "object"
+}

addedOutput schema / properties / human_line / maxLength
```
Added value: +200
```
addedOutput schema / properties / human_line / pattern
```
Added value: +"^[^\\r\\n]*$"
```

addedOutput schema / properties / ids

Added value: +{
+  "additionalProperties": {
+    "type": "string"
+  },
+  "type": "object"
+}

addedOutput schema / properties / next

Added value: +{
+  "minLength": 1,
+  "type": "string"
+}

addedOutput schema / properties / ok
```
Added value: +{
+  "type": "boolean"
+}
```
addedOutput schema / properties / renew_nudge
```
Added value: +{
+  "type": "object"
+}
```

addedOutput schema / properties / urls

Added value: +{
+  "additionalProperties": {
+    "type": "string"
+  },
+  "type": "object"
+}

changedOutput schema / required

Previous value: -[
-  "result"
-]New value: +[
+  "result",
+  "ok",
+  "human_line",
+  "next",
+  "ids",
+  "urls"
+]

Changed14 schema fields changedOct 16, 2026

addedOutput schema / properties / active
```
Added value: +{
+  "type": "boolean"
+}
```
addedOutput schema / properties / daily_recap
```
Added value: +{
+  "type": "object"
+}
```
addedOutput schema / properties / day_pass
```
Added value: +{
+  "type": "object"
+}
```

addedOutput schema / properties / expires_at

Added value: +{
+  "type": [
+    "string",
+    "null"
+  ]
+}

addedOutput schema / properties / human_line
```
Added value: +{
+  "type": "string"
+}
```

addedOutput schema / properties / intents

Added value: +{
+  "items": {
+    "type": "object"
+  },
+  "type": "array"
+}

addedOutput schema / properties / next_up
```
Added value: +{
+  "type": "string"
+}
```
addedOutput schema / properties / payment
```
Added value: +{
+  "type": "object"
+}
```
addedOutput schema / properties / resume_status
```
Added value: +{
+  "type": "string"
+}
```
addedOutput schema / properties / resumed_result
```
Added value: +{
+  "type": "object"
+}
```

addedOutput schema / properties / seconds_left

Added value: +{
+  "type": [
+    "number",
+    "null"
+  ]
+}

addedOutput schema / properties / tier

Added value: +{
+  "type": [
+    "string",
+    "null"
+  ]
+}

addedOutput schema / properties / today_url
```
Added value: +{
+  "type": "string"
+}
```

addedOutput schema / properties / unlock_link

Added value: +{
+  "type": [
+    "string",
+    "null"
+  ]
+}

Changed3 schema fields changedOct 10, 2026

changedInput schema / properties / _caller_label / description

Previous value: -"Optional self-reported caller label. It is recorded as a claim, not independently verified."New value: +"Optional caller label recorded as a caller-reported claim in the receipt."

changedInput schema / properties / _session_id / description

Previous value: -"Optional stable Zambo session ID used to preserve continuity across tool calls."New value: +"Optional stable bot-job ID. Reuse it across calls to bind a Day Pass and keep the job ledger together."

addedInput schema / properties / _zambo_key

Added value: +{
+  "description": "Optional opaque Zambo access capability. Never place it in a URL or public log.",
+  "maxLength": 160,
+  "type": "string"
+}

Changed6 schema fields changedOct 10, 2026

changedOutput schema / additionalProperties
```
Previous value: -trueNew value: +false
```

addedOutput schema / properties / result

Added value: +{
+  "description": "The tool's observed JSON value or plain-text result."
+}

removedOutput schema / properties / safe

Removed value: -{
-  "type": "boolean"
-}

removedOutput schema / properties / sanitized
```
Removed value: -{
-  "type": "string"
-}
```

removedOutput schema / properties / threats

Removed value: -{
-  "items": {
-    "type": "string"
-  },
-  "type": "array"
-}

addedOutput schema / required
```
Added value: +[
+  "result"
+]
```

Changed2 schema fields changedOct 10, 2026

addedInput schema / properties / _caller_label

Added value: +{
+  "description": "Optional self-reported caller label. It is recorded as a claim, not independently verified.",
+  "maxLength": 80,
+  "type": "string"
+}

addedInput schema / properties / _session_id

Added value: +{
+  "description": "Optional stable Zambo session ID used to preserve continuity across tool calls.",
+  "maxLength": 64,
+  "type": "string"
+}

Changed2 schema fields changedOct 2, 2026

addedInput schema / properties / _continuity_ai_label

Added value: +{
+  "description": "Optional self-reported AI client label for the private continuity timeline. Zambo does not independently verify the client.",
+  "maxLength": 48,
+  "type": "string"
+}

changedInput schema / properties / system / description

Previous value: -"Your system prompt — also scanned for prompt leak attempts (optional)"New value: +"Your system prompt - also scanned for prompt leak attempts (optional)"

First observedSep 26, 2026

TDQS

A3.7/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover safety (readOnly, idempotent, non-destructive), so the description's added value is the output contract: risk score, safe/review/block recommendation, attack indicators, and an offline-verifiable AER-1 receipt. It does not disclose latency differences between modes or any rate/quota behavior, which limits it below a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four short sentences, front-loaded with the purpose before outputs. The output enumeration is somewhat redundant given an output schema exists, but nothing is padded or vague.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 12 optional-heavy parameters, full schema coverage, annotations, and an output schema, the description needs to establish purpose and the shape of the result, which it does. Details on fast vs deep mode, certificate freezing, and continuity/capability params are left entirely to the schema, which is acceptable here.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description's only parameter statement, "Required arguments: prompt," merely restates the schema's required list and adds no new meaning about mode, system, context, or certificate options.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence names a specific verb and resource: "Detection and analysis of prompt injection, jailbreak, and policy-bypass attempts." It also enumerates the outputs (risk score, recommendation, indicators, rewrite). It does not explicitly distinguish itself from adjacent siblings like scam_check, so it falls short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit when-to-use or when-not-to-use guidance and no named alternatives. The use case is implied by the purpose (validate user input before processing) and the example prompt, but the agent must infer the trigger condition.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Zambo tools Inspect

Try in Browser

Context Every Agent Can ShareAgents share what they learn, hand off work, and keep it when you switch models. Start with 5 GB free.fulcradynamics.comAd

Glama MCP Gateway

Add one secure layer between your agents and this server.