GlyphGuard

dev.workers.mike-tusa.glyphguardPublished by glyphguard.mike-tusa.workers.devOfficial publisherv0.1.0Updated Oct 24, 2026

Find hidden Unicode (zero-width, bidi, tag payloads), homoglyphs and lookalike names in text.

VerifiedStreamable HTTPWeb executable

Overview

GlyphGuard's hosted MCP server (glyphguard.mike-tusa.workers.dev), published by glyphguard.mike-tusa.workers.dev; no sign-in required; Streamable HTTP; 3 tools.

No AI overview yet: these facts come from the registry entry and the server itself.

Publisher
glyphguard.mike-tusa.workers.dev
Endpoint
glyphguard.mike-tusa.workers.dev
Last checked

Installation

In SourceWeft

  1. Open GlyphGuard in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/dev.workers.mike-tusa.glyphguard%2Fglyphguard/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "glyphguard": {
      "type": "http",
      "url": "https://glyphguard.mike-tusa.workers.dev/mcp"
    }
  }
}

Tools

3

scan_text

Scan text for hidden or deceptive Unicode

Find invisible characters, bidi controls (Trojan Source), hidden Unicode tag payloads (decoded), variation-selector runs, control characters, unusual spaces, mixed-script words and lookalike letters. ZWJ/ZWNJ/VS16 in legitimate context (emoji sequences, Persian/Arabic joining, Indic virama) are reported as info joiner_in_context and do not raise risk; elsewhere they stay medium. Lone surrogates are flagged. Returns a risk level (none/low/medium/high), counts, and findings with UTF-16 offsets and code points. Read-only. Same engine as GET /api/scan.

Parameterstextrequired

clean_text

Remove hidden Unicode from text

Return the text with invisible characters, bidi controls, tag characters and control characters removed and unusual spaces turned into normal spaces. By default ZWJ/ZWNJ/VS16 are kept inside emoji sequences, between letters of joining scripts (Arabic, Persian) and after an Indic virama (keep_joiners=true); strict=true removes them everywhere. Optional: map lookalike letters to Latin (lookalikes) and apply NFKC normalisation (nfkc). Read-only. Same engine as GET /api/clean.

Parametersnfkctextrequiredspacesstrictlookalikeskeep_joiners

compare_names

Check a name for lookalike impersonation

Check whether a name, username, domain label or brand looks the same as any of up to 50 protected names (for example "pаypal" with a Cyrillic а vs "paypal"), using a UTS #39-style confusable skeleton (curated subset, case and accents ignored). Read-only. Same engine as GET /api/compare.

Parametersnamerequiredtargetsrequired

Version history

1
  1. v0.1.0LatestOct 22, 2026

Score

83% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.