Prompt-injection scanner for agents: risk score, categories and spans for text, pages, MCP tools
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Scans untrusted text for prompt injection before your agent reads or acts on it: web page text, emails, documents, tool results or another agent's message. Flags instruction overrides, jailbreak personas, system-prompt extraction, fake delimiters, exfiltration URLs, tool hijacking, hidden Unicode and encoded payloads (deterministic rules). Use scan_url when you only have a link (it also checks hidden HTML) and scan_tools for MCP tool definitions. Text up to 100000 characters. Free: 30 calls/day per IP shared by scan_text, scan_url and scan_tools, with full results (max 10/min; invalid input is not counted). After that the tool returns an error with the x402 pay URL ($0.003 USDC on Base, Polygon, Arbitrum One or Solana per call at https://api.youraitools.co/injectscan/v1/scan) or prepaid credits. Returns risk_score (0-100), verdict (safe | suspicious | malicious), flagged, categories[] {category, score, description}, findings[] {rule, category, start, end, text} and free_tier usage. Read-only safety signal, not a guarantee.
The untrusted text to scan, as one plain string (1-100000 characters; longer text is truncated and flagged). Offsets in findings refer to this string.
Tool list last changed Oct 25, 2026.
Scans untrusted text for prompt injection before your agent reads or acts on it: web page text, emails, documents, tool results or another agent's message. Flags instruction overrides, jailbreak personas, system-prompt extraction, fake delimiters, exfiltration URLs, tool hijacking, hidden Unicode and encoded payloads (deterministic rules). Use scan_url when you only have a link (it also checks hidden HTML) and scan_tools for MCP tool definitions. Text up to 100000 characters. Free: 30 calls/day per IP shared by scan_text, scan_url and scan_tools, with full results (max 10/min; invalid input is not counted). After that the tool returns an error with the x402 pay URL ($0.003 USDC on Base, Polygon, Arbitrum One or Solana per call at https://api.youraitools.co/injectscan/v1/scan) or prepaid credits. Returns risk_score (0-100), verdict (safe | suspicious | malicious), flagged, categories[] {category, score, description}, findings[] {rule, category, start, end, text} and free_tier usage. Read-only safety signal, not a guarantee.
| Argument | Type | Description |
|---|---|---|
| text* | string | The untrusted text to scan, as one plain string (1-100000 characters; longer text is truncated and flagged). Offsets in findings refer to this string. |
{
"type": "object",
"required": [
"text"
],
"properties": {
"text": {
"type": "string",
"description": "The untrusted text to scan, as one plain string (1-100000 characters; longer text is truncated and flagged). Offsets in findings refer to this string."
}
}
}Checks MCP / function-calling tool definitions for tool poisoning (hidden instructions, data-exfiltration requests, hijack attempts in names, descriptions and schemas) before your agent installs or calls them. Use scan_text for ordinary content and scan_url for web pages. Up to 100 tools per call. Free: 30 calls/day per IP shared by scan_text, scan_url and scan_tools, with full results (max 10/min; invalid input is not counted). After that the tool returns an error with the x402 pay URL ($0.003 USDC on Base, Polygon, Arbitrum One or Solana per call at https://api.youraitools.co/injectscan/v1/scan) or prepaid credits. Returns the worst risk_score/verdict, flagged, tools_scanned, tools_flagged and tools[] {index, name, risk_score, verdict, categories, findings[] {field, rule, text}}. Read-only safety signal, not a guarantee.
| Argument | Type | Description |
|---|---|---|
| tools* | array | 1-100 tool definitions as objects {name, description, inputSchema} (as returned by an MCP server's tools/list; input_schema or parameters are also read). Every string field, including nested schema descriptions, is scanned. |
{
"type": "object",
"required": [
"tools"
],
"properties": {
"tools": {
"type": "array",
"items": {
"type": "object"
},
"description": "1-100 tool definitions as objects {name, description, inputSchema} (as returned by an MCP server's tools/list; input_schema or parameters are also read). Every string field, including nested schema descriptions, is scanned."
}
}
}Fetches a public web page and scans its visible text plus hidden HTML (comments, hidden elements, alt/aria/meta text) for prompt injection, before your agent browses or summarizes it. Use scan_text if you already have the content and scan_tools for MCP tool definitions. Respects robots.txt and refuses private/internal hosts. Free: 30 calls/day per IP shared by scan_text, scan_url and scan_tools, with full results (max 10/min; invalid input is not counted). After that the tool returns an error with the x402 pay URL ($0.003 USDC on Base, Polygon, Arbitrum One or Solana per call at https://api.youraitools.co/injectscan/v1/scan) or prepaid credits. Returns risk_score (0-100), verdict (safe | suspicious | malicious), flagged, categories[] {category, score, description}, findings[] with location (visible or hidden), url, finalUrl, title, hidden_html {segments_checked, flagged} and page {status, contentType}. Read-only safety signal, not a guarantee.
| Argument | Type | Description |
|---|---|---|
| url* | string | Absolute http:// or https:// URL of a public web page, e.g. "https://example.com/post". Private, loopback and internal hosts are refused; robots.txt is respected. |
{
"type": "object",
"required": [
"url"
],
"properties": {
"url": {
"type": "string",
"description": "Absolute http:// or https:// URL of a public web page, e.g. \"https://example.com/post\". Private, loopback and internal hosts are refused; robots.txt is respected."
}
}
}