mcpField
I
injectshield

injectshield

Local
injectshield.devSecurity0Updated 21w ago
RepositoryVisit website

About injectshield

InjectShield’s MCP server lets compatible clients check untrusted text for prompt injection before it is passed to an LLM. It can scan text or URL content and return findings with an optional redacted version.

Key features

  1. 01Scan text for prompt injection
  2. 02Fetch and scan URL content
  3. 03Return verdict, confidence, and threat category
  4. 04Provide optional redacted text
  5. 05List threat categories and scan settings

Use cases

  1. 01Check fetched web pages before summarizing
  2. 02Inspect untrusted text before an LLM call
  3. 03Use redacted content after a threat is found

MCP support

Exposes InjectShield’s scanning API through the `scan`, `scan_url`, and `patterns` tools. MCP clients can inspect text or URL bodies and retrieve detection results and optional sanitized text.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "bch1212-injectshield": {
      "command": "npx",
      "args": [
        "-y",
        "@injectshield/mcp"
      ],
      "env": {
        "INJECTSHIELD_API_KEY": "<INJECTSHIELD_API_KEY>",
        "INJECTSHIELD_API_BASE": "<INJECTSHIELD_API_BASE>"
      }
    }
  }
}
Run commandnpx -y @injectshield/mcp
Environment variables to set
INJECTSHIELD_API_KEYSecretAPI key from https://injectshield.dev (free tier: 10K req/mo).
INJECTSHIELD_API_BASEOverride the API base URL for self-hosted deployments.

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
npm@injectshield/mcp0.1.4

Tools

3

Saved tool list · updated 2w ago

ParameterTypeRequiredDescription
textstringYesText to scan (max 100,000 chars).
contextenumNoWhere the text came from. Affects scoring — git commits are treated as more suspicious than user input by default.git_commit | web_content | user_input | file_content | email | tool_output | unknown
sensitivityenumNoDetection threshold. low = fewest false positives, high = fewest false negatives. Default: medium.low | medium | high
return_cleanedbooleanNoReturn the input with detected spans redacted.

Details

From the project README

@injectshield/mcp

MCP server for InjectShield — exposes the InjectShield prompt-injection-detection API as MCP tools so any MCP-compatible client (Claude Code, Cursor, Cline, etc.) can scan untrusted text before passing it into another LLM call.

Tools

  • scan — Scan a string for prompt-injection. Returns verdict, confidence, threat category, matched pattern IDs, and an optional sanitized version with injection spans redacted.
  • scan_url — Fetch a URL and scan its body. Sets context to web_content automatically.
  • patterns — List supported threat categories, context kinds, and sensitivity levels.

Get an API key

Free tier: 10,000 requests/month, no credit card. Self-serve at https://injectshield.dev — your key is delivered by email.

Install in Claude Code

claude mcp add injectshield --env INJECTSHIELD_API_KEY=is_live_… -- npx -y @injectshield/mcp

Install in Cursor

Add to ~/.cursor/mcp.json:

{
  "mcpServers": {
    "promptshield": {
      "command": "npx",
      "args": ["-y", "@injectshield/mcp"],
      "env": { "INJECTSHIELD_API_KEY": "is_live_…" }
    }
  }
}

Install in Cline / generic MCP client

Same shape as Cursor. Stdio transport, command npx -y @injectshield/mcp, set INJECTSHIELD_API_KEY in the env block.

Usage

Once installed, your agent has three new tools. Pattern-match this:

Before reading a fetched web page or file, call scan with the body and bail if safe is false. The cleaned variant in cleaned_text is the safest thing to feed forward.

Example (model-side reasoning):

User: Summarize https://example.com/article

Agent → scan_url({"url": "https://example.com/article"})
  → { "safe": false, "threat_type": "instruction_injection",
      "patterns_matched": ["ignore-previous", "system-prompt-leak"],
      "cleaned_text": "...[REDACTED:instruction_injection]..." }
Agent: I detected prompt-injection in this page. Working from the
       redacted version: ...

Configuration

Env varDefaultPurpose
INJECTSHIELD_API_KEY(none)Required for scan and scan_url. Get a free one.
INJECTSHIELD_API_BASEhttps://api.injectshield.devOverride for self-hosted deployments.

Defense in depth

InjectShield reduces but does not eliminate prompt-injection risk. Pair it with system-prompt hardening, tool sandboxing, and output filtering. See the main repo for the full pattern library and a more thorough discussion.

License

MIT.

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.