cloakcheck

app.vercel.cloakcheck-wheat/cloakcheckVersion 1.0.0

Scan a page for hidden prompt-injection payloads targeting AI agents.

Status

Responds170 msNov 14, 2026, 13:39 UTCAnswered our handshake without sign-in.

We could not refresh it, so this page shows the last copy.

Data from the official MCP Registry, checked by run.zero. How we check

Streamable HTTP

https://cloakcheck-wheat.vercel.app/api/mcpResponds170 msNov 14, 2026, 13:39 UTC

No sign-in

claude mcp add --transport http cloakcheck https://cloakcheck-wheat.vercel.app/api/mcp

1
2
3

Settings > Connectors > Add custom connector
Name: cloakcheck
Remote MCP server URL: https://cloakcheck-wheat.vercel.app/api/mcp

{
  "mcpServers": {
    "cloakcheck": {
      "url": "https://cloakcheck-wheat.vercel.app/api/mcp"
    }
  }
}

code --add-mcp '{"name":"cloakcheck","type":"http","url":"https://cloakcheck-wheat.vercel.app/api/mcp"}'

Built your own server? run.zero hosts MCP servers on European infrastructure.

1 tools

Tools of cloakcheck
	Description		Read-only	Idempotent	Open world
`check_page_for_injection`Scan a single web page for content planted to hijack an AI agent reading it -- invisible unicode (zero-width chars, the unicode 'tag' block used for steganographic prompt injection), CSS-hidden instruction text, and instruction-shaped language in alt/title/aria-label attributes a human would never read. Does NOT judge whether visible body text is safe -- only content hidden from normal human reading flow is flagged, so a page that legitimately discusses prompt injection won't false-positive on itself. Call this before an autonomous shopping/browsing agent acts on a page's content (add to cart, follow instructions found on the page, etc).	Scan a single web page for content planted to hijack an AI agent reading it -- invisible unicode (zero-width chars, the unicode 'tag' block used for steganographic prompt injection), CSS-hidden instruction text, and instruction-shaped language in alt/title/aria-label attributes a human would never read. Does NOT judge whether visible body text is safe -- only content hidden from normal human reading flow is flagged, so a page that legitimately discusses prompt injection won't false-positive on itself. Call this before an autonomous shopping/browsing agent acts on a page's content (add to cart, follow instructions found on the page, etc).	Not declared	Not declared	Not declared	Not declared

Registry status: Active
Published: Sep 13, 2026
Updated: Sep 13, 2026
Website: https://cloakcheck-wheat.vercel.app/⁠ (opens in a new tab)
Repository: Not given
Categories (suggested): AI modelsSuggested categories are assigned automatically from the registry text and may be wrong. Verified operators can correct them.
GDPR: Not declared