Skip to main content
Glama
Duffey234

injectscan

by Duffey234
OverviewSchemaSourceRelated ServersDiscussionsAdmin
JavaScript
Hybrid

InjectScan

Prompt-injection detection for AI agents (MCP server + x402 API). Safety check only.

InjectScan is a deterministic, documented rule engine. It returns a risk score (0-100), a verdict (safe / suspicious / malicious), the categories that fired, and every finding as a character span in your original text, so you can highlight or strip it. Use it on web pages, emails, documents, tool results and other agents' messages before your agent acts on them.

  • Hosted remote MCP: https://api.youraitools.co/injectscan/mcp (Streamable HTTP)

  • Free tier: 30 full scans/day per IP (tools scan_text, scan_url, scan_tools) on the remote MCP endpoint, then $0.003 USDC per scan over x402, in USDC on Base, Polygon, Arbitrum One or Solana. No account or API key.

  • Hosted API: https://api.youraitools.co/injectscan (GET|POST /v1/scan ($0.003; send text, url or tools), free GET|POST /v1/scan/preview (text up to 2,000 characters, 10/min per IP))

  • Local stdio MCP server: this repo. Starts with no key, no account and no npm registry package.

  • MCP Registry: co.youraitools/injectscan

  • License: MIT

Use the hosted server (no install)

Claude Code:

claude mcp add --transport http injectscan https://api.youraitools.co/injectscan/mcp

Claude Desktop: Settings > Connectors > Add custom connector with the URL above, or in claude_desktop_config.json:

{ "mcpServers": { "injectscan": { "command": "npx", "args": ["-y", "mcp-remote", "https://api.youraitools.co/injectscan/mcp"] } } }

Cursor (~/.cursor/mcp.json), or one click: Add to Cursor

{ "mcpServers": { "injectscan": { "url": "https://api.youraitools.co/injectscan/mcp" } } }

Each free result includes an upgrade field with the calls left today. Past the daily limit the tool returns a payment_required (402) result with the paid x402 URL.

Related MCP server: mcp-guardian

Self-host: run from source (no npm registry)

Requires Node.js 20+ (or Docker). The server has no runtime dependencies.

git clone https://github.com/Duffey234/injectscan.git
cd injectscan
npm ci --omit=dev
node src/mcp-stdio.js        # stdio MCP server (newline-delimited JSON-RPC 2.0)

No git? Download the source tarball from the mirror instead: curl -sL https://agentgate-source.pages.dev/x402-prompt-injection-scan/x402-prompt-injection-scan.tar.gz | tar xz.

MCP client config (use the absolute path of your checkout):

{ "mcpServers": { "injectscan": { "command": "node", "args": ["/absolute/path/to/injectscan/src/mcp-stdio.js"] } } }

Claude Code: claude mcp add injectscan -- node /absolute/path/to/injectscan/src/mcp-stdio.js

Tool scan_text runs the same rule engine locally, up to 100,000 characters, fully offline: nothing leaves your machine. Page scans (url, visible + hidden HTML) and MCP tool-poisoning scans (tools) run on the hosted API.

Docker

docker build -t injectscan-mcp .
docker run -i --rm injectscan-mcp
{ "mcpServers": { "injectscan": { "command": "docker", "args": ["run", "-i", "--rm", "injectscan-mcp"] } } }

Test

npm test        # full test suite (node:test, Node 20 and 22, no network, no key)

Full source

The complete hosted service (Cloudflare Worker, x402 v2 + v1, remote MCP) is on the source mirror: https://agentgate-source.pages.dev/x402-prompt-injection-scan/

Built by YourAITools. Informational tooling, safety check only; no warranty.

Available Tools

1 tool
scan_textScan text for prompt injectionA
Read-onlyIdempotent

Check text your agent is about to read (a web page, email, document, tool result or another agent's message) for prompt injection before acting on it. Returns risk_score 0-100, verdict (safe | suspicious | malicious), categories and the exact matching spans. Runs locally, up to 100,000 characters.

NameRequiredDescriptionDefault
textYesText to scan (up to 100,000 characters)

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish this as a safe, idempotent, closed-world read. The description adds genuinely new behavioral facts: it runs locally (no data exfiltration) and accepts up to 100,000 characters. It also outlines the response shape (risk_score, verdict, categories, spans), though it says nothing about latency or cost.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three dense sentences with no filler: what to scan, when, what comes back, and where it executes. The usage condition is front-loaded ahead of the return-value details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description correctly compensates by naming the return fields, and it covers execution locality and the size cap. Nothing essential for correct invocation is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is one parameter and schema coverage is 100%; the description only repeats the 100,000-character limit already stated in the schema. It adds no guidance on encoding, truncation behavior, or what happens with oversized input.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (check/scan) and resource (text the agent is about to read) and enumerates the input sources it covers: web page, email, document, tool result, or another agent's message. The purpose cannot be confused with any other operation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Timing is explicit: run it 'before acting on' untrusted content. There are no sibling tools to route between, so no alternatives need naming, but the description does not say when a scan can be skipped (e.g., trusted internal text).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 1 tool updatev0.1.4
    • First observedscan_text
Deploy Server
Context Every Agent Can ShareAgents share what they learn, hand off work, and keep it when you switch models. Start with 5 GB free.fulcradynamics.comAd

TDQS

A4.3/5.0

Scored across 1 tool

Disambiguation5/5

There is only one tool, so there is no possibility of misselection between overlapping tools. Its purpose (scanning untrusted text for prompt injection) is unambiguous and self-contained.

Naming Consistency5/5

The single name scan_text follows a clear verb_noun snake_case convention. No competing conventions exist to create inconsistency.

Tool Count3/5

One tool is very thin for a server surface, even a deliberately narrow one. It covers the core operation, but a single endpoint leaves little room for complementary operations an agent might expect.

Completeness4/5

The tool covers the primary input path (arbitrary text up to 100k chars) and returns the expected risk score, verdict, categories and spans. Gaps are minor: no file/URL ingestion, no batch scanning, and no apparent way to scan content above the character limit in chunks.

Maintenance

ActivityMaintained
ResponsivenessUnresponsive

Resources

Related MCP Connectors

Related MCP Servers

  • InjectShield

    bch1212
    A
    license
    Not graded
    quality
    C
    maintenance
    MCP server that provides tools to scan text and URLs for prompt injection attacks, protecting AI agents from adversarial inputs.
    MIT

  • mcp-guardian

    alexandriashai
    A
    license
    Not graded
    quality
    C
    maintenance
    Scans MCP tool descriptions for prompt injection attacks, including cross-tool instructions, privilege escalation, and data exfiltration patterns. It can be used as a CLI scanner or integrated as an MCP server itself.
    39 npm
    6
    MIT

  • mcp-fortress

    mcp-fortress
    A
    license
    Not graded
    quality
    D
    maintenance
    Scans MCP servers for security vulnerabilities, prompt injection, and tool poisoning, providing risk scores and protection.
    4
    MIT

  • malskanner

    Octolabo
    A
    license
    Not graded
    quality
    C
    maintenance
    MCP server to scan a repository for hidden prompt injection payloads and return a REFUSE/WARN/OK verdict, allowing AI agents to gate their own trust.
    14 npm
    5
    MIT