InjectScan

io.github.agentgate-builder/x402-prompt-injection-scanVersion 0.1.0

Prompt-injection scanner for agents: risk score, categories and spans for text, pages, MCP tools

Status

Responds313 msNov 14, 2026, 14:44 UTCAnswered our handshake without sign-in.

Registry data may be out of date

We could not refresh it, so this page shows the last copy.

Last checked: Nov 14, 2026, 14:44 UTC
Latency: 313 ms
Remotes responding: 1 of 1
Sign-in: No sign-in
Hosting: Hosted outside the EU (detected)
Registry data as of: Nov 14, 2026, 22:14 UTC

Data from the official MCP Registry, checked by run.zero. How we check

Connect

Streamable HTTP

https://injectscan.agentgate.workers.dev/mcpResponds313 msNov 14, 2026, 14:44 UTC

No sign-in

Claude Code

claude mcp add --transport http x402-prompt-injection-scan https://injectscan.agentgate.workers.dev/mcp

Claude Desktop and claude.ai

1
2
3

Settings > Connectors > Add custom connector
Name: x402-prompt-injection-scan
Remote MCP server URL: https://injectscan.agentgate.workers.dev/mcp

Cursor

{
  "mcpServers": {
    "x402-prompt-injection-scan": {
      "url": "https://injectscan.agentgate.workers.dev/mcp"
    }
  }
}

VS Code

code --add-mcp '{"name":"x402-prompt-injection-scan","type":"http","url":"https://injectscan.agentgate.workers.dev/mcp"}'

Built your own server? run.zero hosts MCP servers on European infrastructure.

Host your own MCP server on run.zero

Tools

3 tools

Tools of InjectScan
	Description		Read-only	Idempotent	Open world
`scan_text`Scans untrusted text for prompt injection before your agent reads or acts on it: web page text, emails, documents, tool results or another agent's message. Flags instruction overrides, jailbreak personas, system-prompt extraction, fake delimiters, exfiltration URLs, tool hijacking, hidden Unicode and encoded payloads (deterministic rules). Use scan_url when you only have a link (it also checks hidden HTML) and scan_tools for MCP tool definitions. Text up to 100000 characters. Free: 30 calls/day per IP shared by scan_text, scan_url and scan_tools, with full results (max 10/min; invalid input is not counted). After that the tool returns an error with the x402 pay URL ($0.003 USDC on Base, Polygon, Arbitrum One or Solana per call at https://api.youraitools.co/injectscan/v1/scan) or prepaid credits. Returns risk_score (0-100), verdict (safe \| suspicious \| malicious), flagged, categories[] {category, score, description}, findings[] {rule, category, start, end, text} and free_tier usage. Read-only safety signal, not a guarantee.	Scans untrusted text for prompt injection before your agent reads or acts on it: web page text, emails, documents, tool results or another agent's message. Flags instruction overrides, jailbreak personas, system-prompt extraction, fake delimiters, exfiltration URLs, tool hijacking, hidden Unicode and encoded payloads (deterministic rules). Use scan_url when you only have a link (it also checks hidden HTML) and scan_tools for MCP tool definitions. Text up to 100000 characters. Free: 30 calls/day per IP shared by scan_text, scan_url and scan_tools, with full results (max 10/min; invalid input is not counted). After that the tool returns an error with the x402 pay URL ($0.003 USDC on Base, Polygon, Arbitrum One or Solana per call at https://api.youraitools.co/injectscan/v1/scan) or prepaid credits. Returns risk_score (0-100), verdict (safe \| suspicious \| malicious), flagged, categories[] {category, score, description}, findings[] {rule, category, start, end, text} and free_tier usage. Read-only safety signal, not a guarantee.	Not declared	Yes	Yes	No
`scan_tools`Checks MCP / function-calling tool definitions for tool poisoning (hidden instructions, data-exfiltration requests, hijack attempts in names, descriptions and schemas) before your agent installs or calls them. Use scan_text for ordinary content and scan_url for web pages. Up to 100 tools per call. Free: 30 calls/day per IP shared by scan_text, scan_url and scan_tools, with full results (max 10/min; invalid input is not counted). After that the tool returns an error with the x402 pay URL ($0.003 USDC on Base, Polygon, Arbitrum One or Solana per call at https://api.youraitools.co/injectscan/v1/scan) or prepaid credits. Returns the worst risk_score/verdict, flagged, tools_scanned, tools_flagged and tools[] {index, name, risk_score, verdict, categories, findings[] {field, rule, text}}. Read-only safety signal, not a guarantee.	Checks MCP / function-calling tool definitions for tool poisoning (hidden instructions, data-exfiltration requests, hijack attempts in names, descriptions and schemas) before your agent installs or calls them. Use scan_text for ordinary content and scan_url for web pages. Up to 100 tools per call. Free: 30 calls/day per IP shared by scan_text, scan_url and scan_tools, with full results (max 10/min; invalid input is not counted). After that the tool returns an error with the x402 pay URL ($0.003 USDC on Base, Polygon, Arbitrum One or Solana per call at https://api.youraitools.co/injectscan/v1/scan) or prepaid credits. Returns the worst risk_score/verdict, flagged, tools_scanned, tools_flagged and tools[] {index, name, risk_score, verdict, categories, findings[] {field, rule, text}}. Read-only safety signal, not a guarantee.	Not declared	Yes	Yes	No
`scan_url`Fetches a public web page and scans its visible text plus hidden HTML (comments, hidden elements, alt/aria/meta text) for prompt injection, before your agent browses or summarizes it. Use scan_text if you already have the content and scan_tools for MCP tool definitions. Respects robots.txt and refuses private/internal hosts. Free: 30 calls/day per IP shared by scan_text, scan_url and scan_tools, with full results (max 10/min; invalid input is not counted). After that the tool returns an error with the x402 pay URL ($0.003 USDC on Base, Polygon, Arbitrum One or Solana per call at https://api.youraitools.co/injectscan/v1/scan) or prepaid credits. Returns risk_score (0-100), verdict (safe \| suspicious \| malicious), flagged, categories[] {category, score, description}, findings[] with location (visible or hidden), url, finalUrl, title, hidden_html {segments_checked, flagged} and page {status, contentType}. Read-only safety signal, not a guarantee.	Fetches a public web page and scans its visible text plus hidden HTML (comments, hidden elements, alt/aria/meta text) for prompt injection, before your agent browses or summarizes it. Use scan_text if you already have the content and scan_tools for MCP tool definitions. Respects robots.txt and refuses private/internal hosts. Free: 30 calls/day per IP shared by scan_text, scan_url and scan_tools, with full results (max 10/min; invalid input is not counted). After that the tool returns an error with the x402 pay URL ($0.003 USDC on Base, Polygon, Arbitrum One or Solana per call at https://api.youraitools.co/injectscan/v1/scan) or prepaid credits. Returns risk_score (0-100), verdict (safe \| suspicious \| malicious), flagged, categories[] {category, score, description}, findings[] with location (visible or hidden), url, finalUrl, title, hidden_html {segments_checked, flagged} and page {status, contentType}. Read-only safety signal, not a guarantee.	Not declared	Yes	Yes	Yes

Details

Registry status: Active
Published: Oct 21, 2026
Updated: Oct 21, 2026
Website: https://injectscan.agentgate.workers.dev/⁠ (opens in a new tab)
Repository: https://github.com/agentgate-builder/x402-prompt-injection-scan⁠ (opens in a new tab)
Categories (suggested): AI models SecuritySuggested categories are assigned automatically from the registry text and may be wrong. Verified operators can correct them.
GDPR: Not declared

Are you the operator? Claim this listing