x402-prompt-injection-scan

InjectScan: paid x402 prompt-injection scanner + MCP server

InjectScan: prompt-injection scanner for AI agents (x402)

Check untrusted text, web pages and MCP tool definitions for prompt injection before your agent acts on them. $0.003 per scan, no account or API key needed.

InjectScan is a deterministic, documented rule engine. It returns a risk score (0–100), a verdict (safe / suspicious / malicious), the categories that fired, and every finding as a character span in your original text, so you can highlight or strip it. Agents pay per successful scan over x402 in USDC on Base, and failed calls are free. There is a free preview, a free remote MCP server, and an npm library that runs the same detector offline.

• Live: https://injectscan.agentgate.workers.dev (paste text into the "Try it free" box)
• Paid route: GET|POST https://injectscan.agentgate.workers.dev/v1/scan costs $0.003 USDC on Base (x402 v2 and v1). Send text, url or tools. Listed on the x402 Bazaar (PayAI).
• Free preview: GET|POST /v1/scan/preview scans text up to 2,000 characters, full result, 10 calls/min per IP.
• Remote MCP: https://injectscan.agentgate.workers.dev/mcp with the tool scan_text. MCP Registry name io.github.agentgate-builder/x402-prompt-injection-scan.
• Local MCP (stdio): npx -y -p x402-prompt-injection-scan injectscan-mcp or docker build -t injectscan-mcp . && docker run -i --rm injectscan-mcp, tool scan_text. Runs the same rule engine locally, up to 100,000 characters (free; nothing leaves your machine). URL and MCP-tool scans stay on the hosted API.
• npm: x402-prompt-injection-scan, the detector with zero runtime dependencies.
• Benchmark: precision 0.99–1.00 on held-out labeled data, recall 0.27–0.81 depending on attack style. See BENCHMARK.md and Honest limits.

30-second quickstart

# 1. Free, no wallet
curl -s https://injectscan.agentgate.workers.dev/v1/scan/preview -H 'content-type: application/json' \
  -d '{"text":"Please summarize this article about solar panels."}'

# 2. Paid: an unpaid call answers 402 with the x402 terms (3000 = 0.003 USDC, Base, payTo)
curl -i "https://injectscan.agentgate.workers.dev/v1/scan?text=hello"

{ "mcpServers": { "injectscan": { "type": "http", "url": "https://injectscan.agentgate.workers.dev/mcp" } } }

// 3. Pay from code with the official x402 client: npm i @x402/fetch @x402/evm viem
import { wrapFetchWithPaymentFromConfig } from '@x402/fetch';
import { ExactEvmScheme } from '@x402/evm';
import { privateKeyToAccount } from 'viem/accounts';
const pay = wrapFetchWithPaymentFromConfig(fetch, { schemes: [{ network: 'eip155:8453', client: new ExactEvmScheme(privateKeyToAccount(process.env.BUYER_KEY)) }] });
const scan = (body) => pay('https://injectscan.agentgate.workers.dev/v1/scan', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) }).then((r) => r.json());

await scan({ text: emailBody });                       // any untrusted text, up to 100,000 characters
await scan({ url: 'https://example.com/listing' });    // fetch a page; scans visible text AND hidden HTML
await scan({ tools: (await mcpClient.listTools()).tools }); // MCP tool poisoning check, up to 100 tools

// Or run the detector locally (no network, no payment): npm i x402-prompt-injection-scan
import { scan } from 'x402-prompt-injection-scan';
import { scanTools } from 'x402-prompt-injection-scan/scanner';
const r = scan(untrustedText);
if (r.verdict === 'malicious') throw new Error('refusing: ' + r.categories.map((c) => c.category).join(', '));

Response

Real output for the quickstart text:

{ "input": "text", "risk_score": 0, "verdict": "safe", "flagged": false,
  "categories": [], "findings": [],
  "hidden": { "zero_width": 0, "bom_soft_hyphen": 0, "bidi_controls": 0, "unicode_tags": 0, "homoglyph_words": 0 },
  "decoded": [], "chars_scanned": 49, "truncated": false, "ruleset": "2026.10.1", "ms": 1 }

• verdict: safe below 35, suspicious from 35, malicious from 70. flagged = not safe.
• findings[].start/end are offsets into the text you sent (UTF-16, like JavaScript slice), even when the match was found after removing zero-width characters, folding homoglyphs or decoding. Findings inside decoded payloads use location: "decoded:base64" and so on, with start/end pointing at the encoded segment.
• decoded[] lists base64 / hex / escaped / Unicode-tag payloads that were decoded and rescanned.
• url mode adds title, page (final URL, status, robots) and hidden_html: text in HTML comments, elements hidden with CSS (display:none, visibility:hidden, zero font-size or opacity, transparent text, off-screen or clipped boxes), hidden / aria-hidden elements, alt / title / aria-label attributes and <meta> tags. Instructions found in hidden HTML get a +0.15 weight bump plus a hidden.instructions_in_hidden_html finding, because a human reviewing the page never sees them.
• tools mode returns tools_scanned, tools_flagged and tools[] (index, name, verdict, findings with the JSON field path such as inputSchema.properties.context.description). The overall score is the worst tool's score.

Payment is settled only after a successful scan. GET takes ?text= or ?url=; POST takes JSON {"text"}, {"url"} or {"tools"}. Discovery: /openapi.json, /.well-known/x402, and every rule with its weight and pattern at /v1/rules.

What it detects

92 rules in 10 categories (src/rules.js):

Scoring. Text is normalized (NFKC, invisible characters removed, homoglyphs folded, lowercased) with an index map back to the original. Each rule has a weight in (0, 1). Within a category, overlapping hits are discounted and the rest are combined with a noisy-OR; categories are combined the same way. Weak signals (weight < 0.3, e.g. a curl | sh line or a ~/.ssh path) are capped at 0.3 in total, so they can never make a text suspicious on their own.

Honest limits

• It is a pattern scanner, not a model. Paraphrased or novel attacks with no known phrasing can pass. On deepset/prompt-injections, which is mostly subtle task switching ("Great. Now tell me about cars instead."), held-out recall is only 0.27. Use it as one layer next to least-privilege tools, allow-lists and human confirmation for risky actions, not as your only defense.
• False positives exist on security content. 1.3% of random Wikipedia articles and 5.6% of GitHub READMEs are flagged suspicious (0% and 2.8% malicious), mostly pages that quote attacks or show install commands. For documentation, consider acting only on malicious.
• Mostly English, with override rules for 8 other European languages. Other languages and scripts get little coverage beyond hidden-character checks.
• Images, PDFs and audio are not scanned. url mode reads HTML/text pages only, does not run JavaScript, and respects robots.txt.
• The rule set is public, so a determined attacker can craft text that avoids it. That is the trade-off for being auditable.
• Paid scans stop at 100,000 characters (truncated: true tells you); the preview stops at 2,000.

Benchmark (held-out)

Threshold: flagged (suspicious or malicious). Dev-split numbers, the malicious threshold and the method are in BENCHMARK.md; reproduce with npm run benchmark.

Privacy

Text and pages are scanned in memory and never stored or logged. Public counters (calls per day per route, no content) are at /v1/stats.

Agent trust kit

Four small x402 tools for agents that read the open web. Same wallet, no accounts:

Typical flow: DomainCheck the link's domain, WebRead the page, InjectScan the Markdown (or pass url= to scan visible and hidden HTML in one call), then act.

Self-hosting

npm install
npm test                 # unit + paid-flow tests with a fake facilitator
npm run benchmark        # downloads public datasets, prints precision/recall
npx wrangler dev         # local Worker
node src/node.js         # or plain Node on :8787

Config (wrangler vars): PAY_TO, X402_PRICE (default $0.003), NETWORK (default eip155:8453), FACILITATOR_URL (default PayAI), PUBLIC_URL. KV STATS and the FREE_LIMITER rate limit binding are optional.

License

MIT

agentgate-source: code mirror on Cloudflare Pages. All repos