injectscan
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| scan_textA | Check text your agent is about to read (a web page, email, document, tool result or another agent's message) for prompt injection before acting on it. Returns risk_score 0-100, verdict (safe | suspicious | malicious), categories and the exact matching spans. Runs locally, up to 100,000 characters. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 1 tool
There is only one tool, so there is no possibility of misselection between overlapping tools. Its purpose (scanning untrusted text for prompt injection) is unambiguous and self-contained.
The single name scan_text follows a clear verb_noun snake_case convention. No competing conventions exist to create inconsistency.
One tool is very thin for a server surface, even a deliberately narrow one. It covers the core operation, but a single endpoint leaves little room for complementary operations an agent might expect.
The tool covers the primary input path (arbitrary text up to 100k chars) and returns the expected risk score, verdict, categories and spans. Gaps are minor: no file/URL ingestion, no batch scanning, and no apparent way to scan content above the character limit in chunks.