This server provides a runtime firewall to detect and block prompt injection attacks in AI agent pipelines, with tiered features and compliance attestation.
Scan text for prompt injection (scan_prompt): Analyze any text (user prompts, RAG documents, tool arguments, or agent-to-agent payloads) for injection threats — returns a risk level (none, low, medium, high, critical), matched patterns, and a recommended action (allow, log, escalate, or block).
Define custom detection rules (define_custom_rule): Create tenant-specific regex-based rules (Pro+ only) with configurable actions (block, escalate, or log) to tailor detection to your use case.
List detection rules (list_rules): View all built-in and custom rules active for a specific tenant.
View scan logs (scan_log): Retrieve recent scan history with optional filtering by risk level. Free tier is limited to the last 100 entries; Pro tier is unbounded.
Generate signed attestations (sign_firewall_attestation): Emit a cryptographically signed report of firewall enforcement activity (total scans, blocks, escalations) over a specified time window — usable as compliance evidence for OWASP LLM01, EU AI Act Article 15, and ISO 42001 Annex A.5.
Enables scanning of prompts for injection attacks before they reach the LLM, with rule management and audit logging, integrated into Windsurf (Codeium).
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Agent Prompt Injection Firewall MCP scan this message for prompt injection attempts"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
AI agent prompt injection firewall MCP
AI agent prompt injection firewall MCP. OWASP LLM Top 10 #1 runtime guard. MIT
# Install via pip
pip install agent_prompt_injection_firewall_mcp
# Or install via Smithery
npx -y @smithery/cli@latest install agent-prompt-injection-firewall-mcp --client claudeRelated MCP server: ZugaShield
MCP protocol compliant
Easy installation
Well-documented API
Production-ready
Active maintenance
This MCP server is built with EU AI Act compliance built-in:
✅ Article 9 — Risk Management System
✅ Article 13 — Transparency & Instructions for Use
✅ Article 15 — Bias Detection & Testing
✅ Article 26 — FRIA Support (where applicable)
✅ Article 50 — AI Content Watermarking (where applicable)
Need help getting compliant? Book a free 15-min diagnostic →
Need custom development, SLA guarantees, or white-label deployment?
Pro: $99/mo — Full MCP suite + EU AI Act tracking
Enterprise: $499/mo — Custom dev + SLA + Dedicated support
View Pricing → | Contact Sales →
This server is part of the MEOK AI Labs ecosystem — 300+ MCP servers for sovereign AI governance.
Domain | Purpose |
EU AI Act compliance marketplace | |
AI safety & monitoring | |
Sovereign AI platform | |
Legacy modernization |
MIT © CSOAI-ORG
Define a tenant-specific detection rule. Pro+ only.
pattern: regex (case-insensitive)
action: block | escalate | log
Inputs: tenant_id (required), rule_name (required), pattern (required), action, +1 more. Returns: result
List built-in + custom rules (if tenant_id provided).
Inputs: tenant_id, api_key. Returns: result
Recent scan log. Pro tier: unbounded. Free tier: last 100.
Inputs: tenant_id (required), risk_filter, limit, api_key. Returns: result
Scan a piece of text for prompt injection. Returns full decision trace.
context: where this text came from (user-prompt | rag-document | tool-arg | a2a-payload)
Returns safe, risk_level (none|low|medium|high|critical), patterns_matched
(list of rule hits), and recommended_action (allow | log | escalate | block).
Inputs: tenant_id (required), text (required), context, api_key. Returns: result
Emit a signed attestation of firewall enforcement. Evidence for OWASP LLM01 + EU AI Act Art 15 (cybersecurity) + ISO 42001 Annex A.5 (security).
Inputs: tenant_id (required), window_start_utc (required), window_end_utc (required), total_scans (required), +4 more. Returns: result
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 5 tools
Each tool has a clearly distinct purpose: rule definition, listing, log viewing, prompt scanning, and attestation. There is no overlap or ambiguity between them.
Tool names follow a consistent verb_noun pattern in snake_case (e.g., define_custom_rule, list_rules, scan_log). The verbs and nouns are appropriate and predictable.
With 5 tools, the set is well-scoped for a prompt injection firewall MCP. It covers the core operations without being too sparse or overly numerous.
The set lacks update and delete operations for custom rules, which are notable gaps. While scanning and compliance are covered, rule lifecycle management is incomplete.
Real-time MCP & A2A prompt-injection, jailbreak, and tool-schema poisoning firewall for AI agents.
Scan web pages, mails, PDFs and tool output for prompt injection before your agent reads them.
Security firewall for AI agents — scans MCP calls for injection, secrets, and risks.
Deterministic runtime safety for AI agents: scan PII, gate tool actions, verify LLM output.
