HallucC — Hallucination & Safety Guardian

Check Safety

check_safety

Read-only

AI 安全网关检测。对 prompt + output 跑 OWASP LLM Top 10 三层检测：40+ 特征规则引擎（注入/越狱/有害内容/敏感信息泄露/欺诈）+ 可选 LLM 深度分析 + 可选幻觉检测。返回 passed、risk_score、risk_level、threats[]（category/severity/match_context/recommendation）、quota。fast=true 走纯规则 <10ms 模式。耗 detect 额度（fast 亦计入）。

Input Schema

Name	Required	Description
`fast`	No	true 走纯规则快速模式（<10ms，无 LLM）→ /guard/check-fast；默认 false 走完整 /guard/check
`output`	Yes	AI 响应（≥1 字，≤50000 字）
`prompt`	No	用户原始输入（默认空，≤50000 字）
`check_hallucination`	No	是否同时检测幻觉，默认 false

Output Schema

Name	Required	Description	Default
`quota`	No
`passed`	No
`summary`	No
`threats`	No
`risk_level`	No
`risk_score`	No
`detection_id`	No
`llm_analysis`	No
`hallucination`	No
`harmful_detected`	No
`injection_detected`	No
`jailbreak_detected`	No

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedOct 19, 2026

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "additionalProperties": {},
+  "properties": {
+    "detection_id": {
+      "anyOf": [
+        {
+          "maximum": 9007199254740991,
+          "minimum": -9007199254740991,
+          "type": "integer"
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "hallucination": {
+      "anyOf": [
+        {},
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "harmful_detected": {
+      "type": [
+        "boolean",
+        "null"
+      ]
+    },
+    "injection_detected": {
+      "type": [
+        "boolean",
+        "null"
+      ]
+    },
+    "jailbreak_detected": {
+      "type": [
+        "boolean",
+        "null"
+      ]
+    },
+    "llm_analysis": {
+      "anyOf": [
+        {},
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "passed": {
+      "type": [
+        "boolean",
+        "null"
+      ]
+    },
+    "quota": {
+      "anyOf": [
+        {
+          "additionalProperties": {},
+          "propertyNames": {
+            "type": "string"
+          },
+          "type": "object"
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "risk_level": {
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "risk_score": {
+      "type": [
+        "number",
+        "null"
+      ]
+    },
+    "summary": {
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "threats": {
+      "anyOf": [
+        {
+          "items": {
+            "additionalProperties": {},
+            "properties": {
+              "category": {
+                "type": [
+                  "string",
+                  "null"
+                ]
+              },
+              "category_name": {
+                "type": [
+                  "string",
+                  "null"
+                ]
+              },
+              "match_context": {
+                "type": [
+                  "string",
+                  "null"
+                ]
+              },
+              "recommendation": {
+                "type": [
+                  "string",
+                  "null"
+                ]
+              },
+              "severity": {
+                "type": [
+                  "string",
+                  "null"
+                ]
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        {
+          "type": "null"
+        }
+      ]
+    }
+  },
+  "type": "object"
+}

First observedOct 8, 2026

TDQS

A3.7/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark this readOnly/non-destructive, so the bar is lower, and the description still adds real behavioral context beyond them: it consumes 'detect' quota even in fast mode, enumerates the three detection layers, and gives the <10ms latency profile. The quota-consumption side effect is the kind of operational cost an agent must know before calling.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One dense, front-loaded paragraph: purpose first, then detection layers, then return fields, then mode/quota caveats. It is information-rich with minimal filler, though the return-field enumeration is somewhat redundant against the output schema and adds density.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With annotations covering the safety profile and an output schema covering return values, the description still supplies the missing operational facts: detection scope, layer composition, mode behavior, latency, and quota cost. An agent has enough to invoke it correctly; only sibling routing against verify_* remains unstated.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so fast/output/prompt/check_hallucination are already fully documented in the schema. The description largely repeats the fast semantics ('fast=true 走纯规则 <10ms') rather than adding syntax or defaults, with only the quota-counting note for fast being new information. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific operation and scope: OWASP LLM Top 10 three-layer detection over prompt + output, with a concrete rule-engine breakdown (injection/jailbreak/harmful content/leakage/fraud). It clearly distinguishes the resource being checked (AI prompt/output safety) from siblings like verify_agent or check_cua_code_audit, though it never names those siblings explicitly to route the agent.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives a mode-selection rule (fast=true for pure-rule <10ms vs default full /guard/check) and warns that quota is consumed either way, which is genuinely useful context. However it offers no explicit when-to-use-this vs when-to-use verify_text/check_cua_actions guidance, leaving the sibling routing to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All HallucC — Hallucination & Safety Guardian tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.