Connect

8 clients · secrets stay placeholders

JSON (mcpServers)Claude CodeCodexOpenCodeCursorVS CodeGemini CLIGoose

{
  "mcpServers": {
    "injectscan": {
      "type": "http",
      "url": "https://api.youraitools.co/injectscan/mcp"
    }
  }
}

claude mcp add --transport http injectscan https://api.youraitools.co/injectscan/mcp

[mcp_servers.injectscan]
url = "https://api.youraitools.co/injectscan/mcp"

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "injectscan": {
      "type": "remote",
      "url": "https://api.youraitools.co/injectscan/mcp",
      "enabled": true
    }
  }
}

{
  "mcpServers": {
    "injectscan": {
      "type": "http",
      "url": "https://api.youraitools.co/injectscan/mcp"
    }
  },
  "deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=injectscan&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vYXBpLnlvdXJhaXRvb2xzLmNvL2luamVjdHNjYW4vbWNwIn0%3D"
}

{
  "servers": {
    "injectscan": {
      "type": "http",
      "url": "https://api.youraitools.co/injectscan/mcp"
    }
  }
}

{
  "mcpServers": {
    "injectscan": {
      "httpUrl": "https://api.youraitools.co/injectscan/mcp"
    }
  }
}

extensions:
  "injectscan":
    enabled: true
    name: "injectscan"
    type: streamable_http
    uri: "https://api.youraitools.co/injectscan/mcp"
    timeout: 300

Quality 71 / 100needs work

protocol75 · weight 25

warn
protocol.modernnewest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
n/a
protocol.statelessonly applies to 2026-07-28 servers
pass
protocol.transportstreamable HTTP
n/a
protocol.list_ttlonly applies to 2026-07-28 servers

authorizationn/a · weight 15

n/a
auth.prm, auth.as_metadata, auth.cimdno remote uses OAuth
n/a
auth.secret_in_urlno templated URL

tool hygiene79 · weight 30

pass
tools.descriptionsevery tool has a description
warn
tools.description_length1 tools have descriptions over 1,024 characters, which crowds the context
pass
tools.schemasevery tool has an object input schema
pass
tools.annotations3 of 3 tools declare readOnlyHint or destructiveHint
fail
tools.directory_hintsno tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: scan_text (destructiveHint); scan_url (destructiveHint); scan_tools (destructiveHint)
pass
tools.token_costabout 974 tokens to load every tool
pass
tools.api_dumptools are not a one-to-one API dump

stability50 · weight 15

pass
stability.changes3 tool changes in 30 days
fail
stability.rug_pull1 tools kept their name but changed most of their description in 30 days; review before trusting them

dependenciesn/a · weight 15

n/a
deps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI package

3 tools, about 974 tokens to load them all · tool set 6a5076759a62 · tools last changed 2026-10-23 · checked 2026-11-07 17:28 UTC

Tool changes

2026-10-23scan_toolsadded
Checks MCP / function-calling tool definitions for tool poisoning (hidden instructions, data-exfiltration requests, hijack attempts in names, descriptions and schemas) before your agent installs or calls them. Use scan_text for ordinary content and scan_url for web pages. Up to 100 tools per call. Free: 30 calls/day per IP shared by scan_text, scan_url and scan_tools, with full results (max 10/min; invalid input is not counted). After that the tool returns an error with the x402 pay URL ($0.003 USDC on Base, Polygon, Arbitrum One or Solana per call at https://api.youraitools.co/injectscan/v1/scan) or prepaid credits. Returns the worst risk_score/verdict, flagged, tools_scanned, tools_flagged and tools[] {index, name, risk_score, verdict, categories, findings[] {field, rule, text}}. Read-only safety signal, not a guarantee.
2026-10-23scan_urladded
Fetches a public web page and scans its visible text plus hidden HTML (comments, hidden elements, alt/aria/meta text) for prompt injection, before your agent browses or summarizes it. Use scan_text if you already have the content and scan_tools for MCP tool definitions. Respects robots.txt and refuses private/internal hosts. Free: 30 calls/day per IP shared by scan_text, scan_url and scan_tools, with full results (max 10/min; invalid input is not counted). After that the tool returns an error with the x402 pay URL ($0.003 USDC on Base, Polygon, Arbitrum One or Solana per call at https://api.youraitools.co/injectscan/v1/scan) or prepaid credits. Returns risk_score (0-100), verdict (safe | suspicious | malicious), flagged, categories[] {category, score, description}, findings[] with location (visible or hidden), url, finalUrl, title, hidden_html {segments_checked, flagged} and page {status, contentType}. Read-only safety signal, not a guarantee.
2026-10-23scan_textchangeddescription, input schemameaning changed
before
Check text your agent is about to read (a web page, email, document, tool result or another agent's message) for prompt injection before acting on it. Returns risk_score 0-100, verdict (safe | suspicious | malicious), categories and the exact matching spans. Free tier: up to 2000 characters; longer text, URLs and MCP tool definitions via the paid x402 endpoint.
after · 29% of words in common
Scans untrusted text for prompt injection before your agent reads or acts on it: web page text, emails, documents, tool results or another agent's message. Flags instruction overrides, jailbreak personas, system-prompt extraction, fake delimiters, exfiltration URLs, tool hijacking, hidden Unicode and encoded payloads (deterministic rules). Use scan_url when you only have a link (it also checks hidden HTML) and scan_tools for MCP tool definitions. Text up to 100000 characters. Free: 30 calls/day per IP shared by scan_text, scan_url and scan_tools, with full results (max 10/min; invalid input is not counted). After that the tool returns an error with the x402 pay URL ($0.003 USDC on Base, Polygon, Arbitrum One or Solana per call at https://api.youraitools.co/injectscan/v1/scan) or prepaid credits. Returns risk_score (0-100), verdict (safe | suspicious | malicious), flagged, categories[] {category, score, description}, findings[] {rule, category, start, end, text} and free_tier usage. Read-only safety signal, not a guarantee.

Full history: list_changes · trend: quality JSON.

Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.

Trust 83 / 100

no-repository

provenance55

liveness100

freshness100

hygiene80

+dns-namespace +website +reachable +uptime-100% +updated-17d-ago -no-repository

Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.

Endpoints

remote	auth	reachable	uptime 30d	p50	protocol	last ok
`https://api.youraitools.co/injectscan/mcp` streamable-http	none	yes	100%	488 ms	2025-11-25	2026-11-07

Tools (3)

`scan_text`read-only	Scans untrusted text for prompt injection before your agent reads or acts on it: web page text, emails, documents, tool results or another agent's message. Flags instruction overrides, jailbreak personas, system-prompt extraction, fake delimiters, exfiltration URLs, tool hijacking, hidden Unicode and encoded payloads (deterministic rules). Use scan_url when you only have a link (it also checks hidden HTML) and scan_tools for MCP tool definitions. Text up to 100000 characters. Free: 30 calls/day per IP shared by scan_text, scan_url and scan_tools, with full results (max 10/min; invalid input is not counted). After that the tool returns an error with the x402 pay URL ($0.003 USDC on Base, Polygon, Arbitrum One or Solana per call at https://api.youraitools.co/injectscan/v1/scan) or prepaid credits. Returns risk_score (0-100), verdict (safe \| suspicious \| malicious), flagged, categories[] {category, score, description}, findings[] {rule, category, start, end, text} and free_tier usage. Read-only safety signal, not a guarantee.
`scan_tools`read-only	Checks MCP / function-calling tool definitions for tool poisoning (hidden instructions, data-exfiltration requests, hijack attempts in names, descriptions and schemas) before your agent installs or calls them. Use scan_text for ordinary content and scan_url for web pages. Up to 100 tools per call. Free: 30 calls/day per IP shared by scan_text, scan_url and scan_tools, with full results (max 10/min; invalid input is not counted). After that the tool returns an error with the x402 pay URL ($0.003 USDC on Base, Polygon, Arbitrum One or Solana per call at https://api.youraitools.co/injectscan/v1/scan) or prepaid credits. Returns the worst risk_score/verdict, flagged, tools_scanned, tools_flagged and tools[] {index, name, risk_score, verdict, categories, findings[] {field, rule, text}}. Read-only safety signal, not a guarantee.
`scan_url`read-only	Fetches a public web page and scans its visible text plus hidden HTML (comments, hidden elements, alt/aria/meta text) for prompt injection, before your agent browses or summarizes it. Use scan_text if you already have the content and scan_tools for MCP tool definitions. Respects robots.txt and refuses private/internal hosts. Free: 30 calls/day per IP shared by scan_text, scan_url and scan_tools, with full results (max 10/min; invalid input is not counted). After that the tool returns an error with the x402 pay URL ($0.003 USDC on Base, Polygon, Arbitrum One or Solana per call at https://api.youraitools.co/injectscan/v1/scan) or prepaid credits. Returns risk_score (0-100), verdict (safe \| suspicious \| malicious), flagged, categories[] {category, score, description}, findings[] with location (visible or hidden), url, finalUrl, title, hidden_html {segments_checked, flagged} and page {status, contentType}. Read-only safety signal, not a guarantee.

Schemas: list_tools.

Similar MCP servers

More from co.youraitools

And 17 more from this publisher.

Official server.json

{
  "name": "co.youraitools/injectscan",
  "_meta": {
    "io.modelcontextprotocol.registry/publisher-provided": {
      "note": "Same server as io.github.agentgate-builder/x402-prompt-injection-scan; that entry can't be updated (its GitHub account is suspended). This co.youraitools name is canonical.",
      "tools": [
        "scan_text"
      ],
      "source": "https://agentgate-source.pages.dev/x402-prompt-injection-scan/",
      "pricing": "MCP tools are free (rate-limited per IP); full results via pay-per-call x402 API, USDC on Base",
      "canonical": true,
      "publisher": "Crypto Money Maker (tools built and run by AI agents with human oversight)",
      "supersedes": "io.github.agentgate-builder/x402-prompt-injection-scan"
    }
  },
  "icons": [
    {
      "src": "https://youraitools.co/favicon.svg",
      "sizes": [
        "any"
      ],
      "mimeType": "image/svg+xml"
    }
  ],
  "title": "InjectScan",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "remotes": [
    {
      "url": "https://api.youraitools.co/injectscan/mcp",
      "type": "streamable-http"
    }
  ],
  "version": "0.1.3",
  "websiteUrl": "https://youraitools.co/guides/prompt-injection-scanner-api",
  "description": "Scan text for prompt injection: risk score, verdict, matched spans. Built by Crypto Money Maker"
}