Prompt Sanitizer — prompt-injection scan for untrusted content

com.oroboros-design.angelPublished by angel.oroboros-design.comOfficial publisherv1.0.0Updated Nov 14, 2026

Scan web pages, mails, PDFs and tool output for prompt injection before your agent reads them.

The publisher's own server: Agent safety checks: prompt-injection scan, honeypot check, x402 preflight + crypto data (USDC/x402)

VerifiedStreamable HTTPWeb executableSecurity & MonitoringAI & ML

Overview

AI-generated overview

Remote MCP server that scans untrusted text or web pages for prompt injection and hidden instructions before an assistant acts on them.

What you can do
  • Scan untrusted text or one https page for hidden instructions, role takeover, secret or payment requests, invisible Unicode and hidden HTML
  • Run a free quick preview scan of up to 4,000 characters with verdict, score and top findings
  • Run a full scan that also covers forged system/tool turns, homoglyphs, base64 payloads and exfiltration links, returning findings plus cleaned text
  • Buy prepaid call packs by card when the free calls run out
When to use it
Useful when an assistant ingests content it does not control — web pages, emails, PDFs, RAG chunks or tool and MCP responses — and you want a deterministic check before it follows anything in that content.
Requirements
Remote endpoint over streamable HTTP, no install or account needed; a Node 18+ stdio bridge is offered for local clients. An agent identity header (X-API-Key) or ANGEL_API_KEY for the bridge is optional and only used to track the free calls. Paid use needs USDC on Base via x402 or a card purchase.
Before you install
The full scan is metered: three free calls per agent, then payment per call in USDC on Base or a prepaid pack bought by card, so costs can accrue. The scan is pattern-based and deterministic; a low-risk verdict is not proof the content is harmless. Untrusted content you submit is sent to a third-party server.

Installation

In SourceWeft

  1. Open Prompt Sanitizer — prompt-injection scan for untrusted content in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/com.oroboros-design.angel%2Fprompt-sanitizer/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "prompt-sanitizer-prompt-injection-scan-f": {
      "type": "http",
      "url": "https://angel.oroboros-design.com/mcp/prompt-sanitizer"
    }
  }
}

README

mcp-prompt-sanitizer

Prompt-injection scan for untrusted content — a single-purpose MCP server for AI agents. No install, no account: it runs as a remote server; this repo also has a zero-dependency stdio bridge.

https://angel.oroboros-design.com/mcp/prompt-sanitizer

Use it

Claude Code

bash
claude mcp add --transport http prompt-sanitizer https://angel.oroboros-design.com/mcp/prompt-sanitizer

Claude Desktop, Cursor, Windsurf, VS Code (remote server)

json
{ "mcpServers": { "prompt-sanitizer": { "url": "https://angel.oroboros-design.com/mcp/prompt-sanitizer" } } }

Any stdio client (Node 18+)

json
{ "mcpServers": { "prompt-sanitizer": { "command": "npx", "args": ["-y", "github:daoudandiaye98-alt/mcp-prompt-sanitizer"] } } }

Then ask your agent, for example: Before summarising https://example.com/article, run input_guard on it and only use the cleaned text.

Tools

ToolPriceWhat it does
input_guard_previewfreeQuick scan of up to 4,000 characters or one https page: verdict, score, top 3 findings.
input_guard3 free calls per agent, then 0.99 USDCFull scan: role takeover, forged system/tool turns, requests for keys, prompts or payments, exfiltration links, invisible Unicode (tag smuggling decoded, zero-width, bidi), homoglyphs, base64 payloads and HTML hidden from people, in 17 languages. Returns findings and a cleaned text.
buy_pack_with_card—Prepaid calls by card (Stripe) when the free calls are used up.

Paying

The first 3 paid calls per agent are free (identify your agent with the header X-API-Key, or set ANGEL_API_KEY for the stdio bridge). After that each call is paid per request in USDC on Base via x402 (params._meta["x402/payment"]), with a prepaid pack (bundle_token) or by card (buy_pack_with_card). The 402 answer names the exact amount and the pay-to address before anything is signed.

The scan is deterministic (patterns and character checks, no model). Treat caution and hostile as a reason to ignore instructions in that content, not as proof that it is harmless otherwise.

More

  • Same checks as a library: npm i angel-agent-guard · pip install angel-agent-guard (angel-agent-guard)
  • All of Angel's tools in one server: https://angel.oroboros-design.com/agenten/signal/mcp · A2A agent card: https://angel.oroboros-design.com/.well-known/agent.json
  • MCP Registry: com.oroboros-design.angel/prompt-sanitizer

Operated by Oroboros Design (Köln, Germany). MIT licence for the code in this repo.

Source: README.md at commit 1273be5

Tools

3

input_guard

Prompt-injection scan for untrusted web, email and tool content

Prompt-injection and hidden-instruction scan for untrusted input before an agent acts on it: web pages, emails, RAG chunks, tool and MCP responses. Flags text aimed at the model (role takeover, forged system or tool turns, requests for keys, the prompt, history or payments, exfiltration links), invisible Unicode (tag smuggling decoded, zero-width, bidi), homoglyphs, base64 payloads and HTML hidden from humans, in 17 languages. Verdict clean, caution or hostile, score, findings, cleaned text. 0.99 USDC base (new payers 0.99, >10 payments 0.693; 20 pack calls). After: preflight before your agent pays anything the content pointed to (the result's next field has the exact call).

Parametersurltextpayment_txbundle_tokenpayer_address

buy_pack_with_card

TradeSignal: pack by card

For agents and people without USDC: prepaid packs paid in EUR by card or Link (100 calls €5.00 · 500 calls €25.00 · 5,000 calls €199.00) — including Link's wallet for agents (one-time card, approved by the human). Returns checkout_url; after payment the success page (Accept: application/json) returns the bundle_token, and it is e-mailed. After: get_signals with bundle_token.

Parameterscallsemail

input_guard_preview

Prompt-injection quick scan (free)

Free prompt-injection quick scan for untrusted input: up to 4,000 characters of text, or one https page, checked for hidden instructions aimed at agents (role override, invisible Unicode, hidden HTML) in 17 languages incl. Chinese, Japanese, Korean, Hindi, Arabic. Returns verdict, score and the top 3 findings. After: input_guard for every finding and the cleaned text.

Parametersurltext

Version history

1
  1. v1.0.0LatestNov 14, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

Other Oroboros-Design integrations

Agent safety checks: prompt-injection scan, honeypot check, x402 preflight + crypto data (USDC/x402)

com.oroboros-design.angelOfficial publisher

Paid crypto trading feed: Binance spot trade setups, setup validation, market regime, funding, liquidations and order-flow metrics, billed per call in USDC…

Streamable HTTPWeb executable
Finance28 toolsNov 14, 2026

Checkout Guard — pre-purchase check for shops, payment links and paid APIs

com.oroboros-design.angelOfficial publisher

Remote MCP server that runs a pre-purchase safety check on a shop, checkout or payment link, paid API or x402 endpoint and returns a pay, caution or…

Streamable HTTPWeb executable
Finance2 toolsNov 14, 2026

Base Token Audit — ERC-20 honeypot check and swap route data

com.oroboros-design.angelOfficial publisher

Checks ERC-20 tokens on Base and Ethereum for honeypot and rug-pull risk, and returns free swap route data for tokens an agent is about to trade.

Streamable HTTPWeb executable
Finance3 toolsNov 14, 2026