protogrid
Sign inAdd to your agent

Search / io.github.agentgate-builder/x402-prompt-injection-scan

InjectScan

R0· no sign-in

Prompt-injection scanner for agents: risk score, categories and spans for text, pages, MCP tools

v0.1.0 · active · repository · website · descriptor JSON · versions

An agent can connect right now, no human step.Remote endpoint, no authentication, reachable on the last probe.
Quality71needs work
Trust96of 100
Uptime, 30 days95%
Latency p50251 ms

Connect

8 clients · secrets stay placeholders
{
  "mcpServers": {
    "x402-prompt-injection-scan": {
      "type": "http",
      "url": "https://injectscan.agentgate.workers.dev/mcp"
    }
  }
}
claude mcp add --transport http x402-prompt-injection-scan https://injectscan.agentgate.workers.dev/mcp
[mcp_servers.x402-prompt-injection-scan]
url = "https://injectscan.agentgate.workers.dev/mcp"

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "x402-prompt-injection-scan": {
      "type": "remote",
      "url": "https://injectscan.agentgate.workers.dev/mcp",
      "enabled": true
    }
  }
}
{
  "mcpServers": {
    "x402-prompt-injection-scan": {
      "type": "http",
      "url": "https://injectscan.agentgate.workers.dev/mcp"
    }
  },
  "deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=x402-prompt-injection-scan&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vaW5qZWN0c2Nhbi5hZ2VudGdhdGUud29ya2Vycy5kZXYvbWNwIn0%3D"
}
{
  "servers": {
    "x402-prompt-injection-scan": {
      "type": "http",
      "url": "https://injectscan.agentgate.workers.dev/mcp"
    }
  }
}
{
  "mcpServers": {
    "x402-prompt-injection-scan": {
      "httpUrl": "https://injectscan.agentgate.workers.dev/mcp"
    }
  }
}
extensions:
  "x402-prompt-injection-scan":
    enabled: true
    name: "x402-prompt-injection-scan"
    type: streamable_http
    uri: "https://injectscan.agentgate.workers.dev/mcp"
    timeout: 300

Quality 71 / 100needs work

protocol75 · weight 25
  • warn
    protocol.modernnewest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
  • n/a
    protocol.statelessonly applies to 2026-07-28 servers
  • pass
    protocol.transportstreamable HTTP
  • n/a
    protocol.list_ttlonly applies to 2026-07-28 servers
authorizationn/a · weight 15
  • n/a
    auth.prm, auth.as_metadata, auth.cimdno remote uses OAuth
  • n/a
    auth.secret_in_urlno templated URL
tool hygiene79 · weight 30
  • pass
    tools.descriptionsevery tool has a description
  • warn
    tools.description_length1 tools have descriptions over 1,024 characters, which crowds the context
  • pass
    tools.schemasevery tool has an object input schema
  • pass
    tools.annotations3 of 3 tools declare readOnlyHint or destructiveHint
  • fail
    tools.directory_hintsno tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: scan_text (destructiveHint); scan_url (destructiveHint); scan_tools (destructiveHint)
  • pass
    tools.token_costabout 974 tokens to load every tool
  • pass
    tools.api_dumptools are not a one-to-one API dump
stability50 · weight 15
  • pass
    stability.changes3 tool changes in 30 days
  • fail
    stability.rug_pull1 tools kept their name but changed most of their description in 30 days; review before trusting them
dependenciesn/a · weight 15
  • n/a
    deps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI package

3 tools, about 974 tokens to load them all · tool set 6a5076759a62 · tools last changed 2026-10-23 · checked 2026-11-07 17:28 UTC

Tool changes

  • scan_toolsadded

    Checks MCP / function-calling tool definitions for tool poisoning (hidden instructions, data-exfiltration requests, hijack attempts in names, descriptions and schemas) before your agent installs or calls them. Use scan_text for ordinary content and scan_url for web pages. Up to 100 tools per call. Free: 30 calls/day per IP shared by scan_text, scan_url and scan_tools, with full results (max 10/min; invalid input is not counted). After that the tool returns an error with the x402 pay URL ($0.003 USDC on Base, Polygon, Arbitrum One or Solana per call at https://api.youraitools.co/injectscan/v1/scan) or prepaid credits. Returns the worst risk_score/verdict, flagged, tools_scanned, tools_flagged and tools[] {index, name, risk_score, verdict, categories, findings[] {field, rule, text}}. Read-only safety signal, not a guarantee.

  • scan_urladded

    Fetches a public web page and scans its visible text plus hidden HTML (comments, hidden elements, alt/aria/meta text) for prompt injection, before your agent browses or summarizes it. Use scan_text if you already have the content and scan_tools for MCP tool definitions. Respects robots.txt and refuses private/internal hosts. Free: 30 calls/day per IP shared by scan_text, scan_url and scan_tools, with full results (max 10/min; invalid input is not counted). After that the tool returns an error with the x402 pay URL ($0.003 USDC on Base, Polygon, Arbitrum One or Solana per call at https://api.youraitools.co/injectscan/v1/scan) or prepaid credits. Returns risk_score (0-100), verdict (safe | suspicious | malicious), flagged, categories[] {category, score, description}, findings[] with location (visible or hidden), url, finalUrl, title, hidden_html {segments_checked, flagged} and page {status, contentType}. Read-only safety signal, not a guarantee.

  • scan_textchangeddescription, input schemameaning changed
    before

    Check text your agent is about to read (a web page, email, document, tool result or another agent's message) for prompt injection before acting on it. Returns risk_score 0-100, verdict (safe | suspicious | malicious), categories and the exact matching spans. Free tier: up to 2000 characters; longer text, URLs and MCP tool definitions via the paid x402 endpoint.

    after · 29% of words in common

    Scans untrusted text for prompt injection before your agent reads or acts on it: web page text, emails, documents, tool results or another agent's message. Flags instruction overrides, jailbreak personas, system-prompt extraction, fake delimiters, exfiltration URLs, tool hijacking, hidden Unicode and encoded payloads (deterministic rules). Use scan_url when you only have a link (it also checks hidden HTML) and scan_tools for MCP tool definitions. Text up to 100000 characters. Free: 30 calls/day per IP shared by scan_text, scan_url and scan_tools, with full results (max 10/min; invalid input is not counted). After that the tool returns an error with the x402 pay URL ($0.003 USDC on Base, Polygon, Arbitrum One or Solana per call at https://api.youraitools.co/injectscan/v1/scan) or prepaid credits. Returns risk_score (0-100), verdict (safe | suspicious | malicious), flagged, categories[] {category, score, description}, findings[] {rule, category, start, end, text} and free_tier usage. Read-only safety signal, not a guarantee.

Full history: list_changes · trend: quality JSON.

Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.

Trust 96 / 100

provenance90
liveness98
freshness100
hygiene100

+repository +namespace-matches-repo +website +reachable +uptime-95% +updated-17d-ago

Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.

Endpoints

remoteauthreachableuptime 30dp50protocollast ok
https://injectscan.agentgate.workers.dev/mcp streamable-httpnoneyes95%251 ms2025-11-252026-11-07

Tools (3)

scan_textread-onlyScans untrusted text for prompt injection before your agent reads or acts on it: web page text, emails, documents, tool results or another agent's message. Flags instruction overrides, jailbreak personas, system-prompt extraction, fake delimiters, exfiltration URLs, tool hijacking, hidden Unicode and encoded payloads (deterministic rules). Use scan_url when you only have a link (it also checks hidden HTML) and scan_tools for MCP tool definitions. Text up to 100000 characters. Free: 30 calls/day per IP shared by scan_text, scan_url and scan_tools, with full results (max 10/min; invalid input is not counted). After that the tool returns an error with the x402 pay URL ($0.003 USDC on Base, Polygon, Arbitrum One or Solana per call at https://api.youraitools.co/injectscan/v1/scan) or prepaid credits. Returns risk_score (0-100), verdict (safe | suspicious | malicious), flagged, categories[] {category, score, description}, findings[] {rule, category, start, end, text} and free_tier usage. Read-only safety signal, not a guarantee.
scan_toolsread-onlyChecks MCP / function-calling tool definitions for tool poisoning (hidden instructions, data-exfiltration requests, hijack attempts in names, descriptions and schemas) before your agent installs or calls them. Use scan_text for ordinary content and scan_url for web pages. Up to 100 tools per call. Free: 30 calls/day per IP shared by scan_text, scan_url and scan_tools, with full results (max 10/min; invalid input is not counted). After that the tool returns an error with the x402 pay URL ($0.003 USDC on Base, Polygon, Arbitrum One or Solana per call at https://api.youraitools.co/injectscan/v1/scan) or prepaid credits. Returns the worst risk_score/verdict, flagged, tools_scanned, tools_flagged and tools[] {index, name, risk_score, verdict, categories, findings[] {field, rule, text}}. Read-only safety signal, not a guarantee.
scan_urlread-onlyFetches a public web page and scans its visible text plus hidden HTML (comments, hidden elements, alt/aria/meta text) for prompt injection, before your agent browses or summarizes it. Use scan_text if you already have the content and scan_tools for MCP tool definitions. Respects robots.txt and refuses private/internal hosts. Free: 30 calls/day per IP shared by scan_text, scan_url and scan_tools, with full results (max 10/min; invalid input is not counted). After that the tool returns an error with the x402 pay URL ($0.003 USDC on Base, Polygon, Arbitrum One or Solana per call at https://api.youraitools.co/injectscan/v1/scan) or prepaid credits. Returns risk_score (0-100), verdict (safe | suspicious | malicious), flagged, categories[] {category, score, description}, findings[] with location (visible or hidden), url, finalUrl, title, hidden_html {segments_checked, flagged} and page {status, contentType}. Read-only safety signal, not a guarantee.

Schemas: list_tools.

Similar MCP servers

  • InjectScanR0quality 71
    co.youraitools/injectscan

    Scan text for prompt injection: risk score, verdict, matched spans. Built by Crypto Money Maker

  • PrescanR0quality 85
    xyz.canisell/prescan

    Agent security pre-checks: prompt-injection scan, MCP tool-poisoning scan, x402 endpoint check.

  • Prompt Injection ScannerR0quality 100
    app.openkrill/injection-scan

    Check text before your agent reads it: hidden instructions, invisible text and links that leak data.

  • prompt-protectionL0
    io.github.mughalhere/prompt-protection

    Scan prompts, tool definitions and model output for injection, and guard agent tool calls.

  • injectcheckL0
    io.github.CloudCorpRecords/injectcheck

    Scan what AI agents read for prompt injection: hidden unicode, comment instructions, exfil, lures.

  • injection-detectorR0quality 79
    io.github.viridis-security/injection-detector

    Formally-verified injection/exfiltration detector for AI agents (MCP-02).

More from io.github.agentgate-builder

  • AgentGateR0quality 85
    io.github.agentgate-builder/agentgate

    Check if an AI agent is registered, Active and Verified in the Concordium Agent Registry (CIS-8004).

  • WebReadR0quality 74
    io.github.agentgate-builder/x402-url-to-markdown

    Read any public web page as clean Markdown for LLMs. Respects robots.txt. Free tier; x402 paid API.

Official server.json
{
  "name": "io.github.agentgate-builder/x402-prompt-injection-scan",
  "title": "InjectScan",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "remotes": [
    {
      "url": "https://injectscan.agentgate.workers.dev/mcp",
      "type": "streamable-http"
    }
  ],
  "version": "0.1.0",
  "repository": {
    "url": "https://github.com/agentgate-builder/x402-prompt-injection-scan",
    "source": "github"
  },
  "websiteUrl": "https://injectscan.agentgate.workers.dev",
  "description": "Prompt-injection scanner for agents: risk score, categories and spans for text, pages, MCP tools"
}