Skip to main content
Glama
CSOAI-ORG

Agent Prompt Injection Firewall MCP

by CSOAI-ORG
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Hybrid

Server Configuration

Describes the environment variables required to run the server.

NameRequiredDescriptionDefault

No arguments

Instructions

Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.

This server publishes no instructions, or was last inspected before Glama recorded them.

Capabilities

Features and capabilities supported by this server

Protocol revision2025-11-25

CapabilityDetails
tools
{
  "listChanged": false
}
prompts
{
  "listChanged": false
}
resources
{
  "subscribe": false,
  "listChanged": false
}
experimental
{}

Tools

Functions exposed to the LLM to take actions

NameDescription
scan_promptA

Scan a piece of text for prompt injection. Returns full decision trace.

  • context: where this text came from (user-prompt | rag-document | tool-arg | a2a-payload) Returns safe, risk_level (none|low|medium|high|critical), patterns_matched (list of rule hits), and recommended_action (allow | log | escalate | block).

define_custom_ruleC

Define a tenant-specific detection rule. Pro+ only.

  • pattern: regex (case-insensitive)

  • action: block | escalate | log

list_rulesC

List built-in + custom rules (if tenant_id provided).

scan_logC

Recent scan log. Pro tier: unbounded. Free tier: last 100.

sign_firewall_attestationC

Emit a signed attestation of firewall enforcement. Evidence for OWASP LLM01 + EU AI Act Art 15 (cybersecurity) + ISO 42001 Annex A.5 (security).

Prompts

Interactive templates invoked by user choice

NameDescription

No prompts

Resources

Contextual data attached and managed by the client

NameDescription

No resources

Deploy Server
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

B3.2/5.0

Scored across 5 tools

Disambiguation5/5

Each tool has a clearly distinct purpose: rule definition, listing, log viewing, prompt scanning, and attestation. There is no overlap or ambiguity between them.

Naming Consistency5/5

Tool names follow a consistent verb_noun pattern in snake_case (e.g., define_custom_rule, list_rules, scan_log). The verbs and nouns are appropriate and predictable.

Tool Count5/5

With 5 tools, the set is well-scoped for a prompt injection firewall MCP. It covers the core operations without being too sparse or overly numerous.

Completeness3/5

The set lacks update and delete operations for custom rules, which are notable gaps. While scanning and compliance are covered, rule lifecycle management is incomplete.

Maintenance

ActivityActive
ResponsivenessNo issues

Resources