# mcp-prompt-sanitizer

Prompt-injection scan for untrusted content — a single-purpose [MCP](https://modelcontextprotocol.io) server for AI agents. No install, no account: it runs as a remote server; this repo also has a zero-dependency stdio bridge.

```
https://angel.oroboros-design.com/mcp/prompt-sanitizer
```

## Use it

**Claude Code**

```bash
claude mcp add --transport http prompt-sanitizer https://angel.oroboros-design.com/mcp/prompt-sanitizer
```

**Claude Desktop, Cursor, Windsurf, VS Code** (remote server)

```json
{ "mcpServers": { "prompt-sanitizer": { "url": "https://angel.oroboros-design.com/mcp/prompt-sanitizer" } } }
```

**Any stdio client** (Node 18+)

```json
{ "mcpServers": { "prompt-sanitizer": { "command": "npx", "args": ["-y", "github:daoudandiaye98-alt/mcp-prompt-sanitizer"] } } }
```

Then ask your agent, for example: *Before summarising https://example.com/article, run input_guard on it and only use the cleaned text.*

## Tools

| Tool | Price | What it does |
|---|---|---|
| `input_guard_preview` | free | Quick scan of up to 4,000 characters or one https page: verdict, score, top 3 findings. |
| `input_guard` | 3 free calls per agent, then 0.99 USDC | Full scan: role takeover, forged system/tool turns, requests for keys, prompts or payments, exfiltration links, invisible Unicode (tag smuggling decoded, zero-width, bidi), homoglyphs, base64 payloads and HTML hidden from people, in 17 languages. Returns findings and a cleaned text. |
| `buy_pack_with_card` | — | Prepaid calls by card (Stripe) when the free calls are used up. |

## Paying

The first 3 paid calls per agent are free (identify your agent with the header `X-API-Key`, or set `ANGEL_API_KEY` for the stdio bridge). After that each call is paid per request in USDC on Base via [x402](https://x402.org) (`params._meta["x402/payment"]`), with a prepaid pack (`bundle_token`) or by card (`buy_pack_with_card`). The 402 answer names the exact amount and the pay-to address before anything is signed.

The scan is deterministic (patterns and character checks, no model). Treat `caution` and `hostile` as a reason to ignore instructions in that content, not as proof that it is harmless otherwise.

## More

- Same checks as a library: `npm i angel-agent-guard` · `pip install angel-agent-guard` ([angel-agent-guard](https://github.com/daoudandiaye98-alt/angel-agent-guard))
- All of Angel's tools in one server: `https://angel.oroboros-design.com/agenten/signal/mcp` · A2A agent card: `https://angel.oroboros-design.com/.well-known/agent.json`
- MCP Registry: `com.oroboros-design.angel/prompt-sanitizer`

Operated by Oroboros Design (Köln, Germany). MIT licence for the code in this repo.