Prompt Injection Scanner

io.github.4hmetuyarPublished by GitHub account 4hmetuyarv0.2.2Updated Oct 24, 2026

Scans RAG content/scraped pages for indirect prompt injection

VerifiedSTDIODesktop onlyKnowledge & MemorySecurity & Monitoring

Overview

AI-generated overview

Local MCP server that scans RAG chunks, scraped pages and documents for indirect prompt injection before an assistant reads them.

What you can do
  • Scan a text snippet or document for injection payloads
  • Scan a single file, or recursively scan a directory such as a RAG knowledge base
  • List the supported detection patterns by category
  • Report findings with severity, an explanation of the risk and a recommended fix
  • Produce SARIF output and a CLI scan mode for CI/CD pipelines
When to use it
Use it when an assistant ingests untrusted content — retrieved RAG chunks, scraped web pages, third-party documents — and you want a check for embedded instructions, hidden text or exfiltration attempts before that content enters the context.
Requirements
Runs locally over stdio via npx from the npm package; Node.js required. No accounts, API keys or environment variables are needed for the default scan. The optional LLM judge needs a model endpoint configured through GUARDBEE_JUDGE_URL and GUARDBEE_JUDGE_MODEL.
Before you install
Findings are heuristic text-pattern matches, not intent analysis, so every hit should be reviewed manually. The optional judge sends file content to the configured endpoint; a non-local endpoint requires an explicit flag and https. Telemetry is off by default and, when enabled with GUARDBEE_TELEMETRY=1, sends tool names, durations and short parameter values such as file paths.

Installation

In SourceWeft

  1. Open Prompt Injection Scanner in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@guardbee/mcp-prompt-injection-scanner

🇬🇧 English | 🇹🇷 Türkçe | 🇨🇳 中文 | 🇯🇵 日本語 | 🇰🇷 한국어 | 🇧🇷 Português | 🇪🇸 Español | 🇩🇪 Deutsch

[npm version] [npm downloads] [License: MIT]

An MCP (Model Context Protocol) server that scans content — a RAG chunk, a scraped web page, a document — for indirect prompt injection payloads.

ai-code-scanner and mcp-server-auditor scan code; this package scans data. In classic prompt injection, the attacker writes a malicious prompt themselves; in indirect prompt injection, the attacker never talks to the model at all — instead they embed instructions in a document, web page, or tool result the model will later read. The moment the model pulls this content into its context via a RAG retrieval or a web fetch, the embedded instruction appears to carry the same authority as the user's own instructions.

Telemetry is off by default. With GUARDBEE_TELEMETRY=1 it sends the server, tool, success, duration and short parameter values such as a file path; longer strings and fields like content, token or password are replaced with a placeholder. See @guardbee/mcp-telemetry.

Web page/RAG document ──► prompt-injection-scanner ──► LLM context              │              ├─ Instruction override   ("ignore all previous instructions", "önceki talimatları yok say")              ├─ Role spoofing          ("System:", <|im_start|>, [INST], <system>)              ├─ Hidden text            (zero-width, Unicode tag and bidi characters, display:none + instruction, HTML comment)              ├─ Direct address         ("Dear AI, ...")              └─ Exfiltration           (system prompt extraction request, data → URL instruction, templated img beacon)

Features

  • 17 patterns, 5 categories — instruction-override, role-spoofing, hidden-text, direct-address, exfiltration. English and Turkish phrasing
  • The rules live in @guardbee/guard-core, shared with @guardbee/mcp-security-proxy, so a phrase this scanner reports is the same phrase the proxy blocks at runtime
  • Every finding includes why it's risky and what to do about it (recommendation) — not just "found it"
  • SARIF 2.1.0 output — CI/CD integration (e.g. auto-scanning a knowledge-base repo on every PR)
  • Config file support via guardbee.yml
  • 45 unit tests — a positive and a negative (false-positive) scenario for every pattern; known false-positive sources like emoji ZWJ sequences and ordinary display:none modals are specifically tested

Quick Start

Claude Desktop / MCP Client

json
{  "mcpServers": {    "guardbee-prompt-injection-scanner": {      "command": "npx",      "args": ["-y", "@guardbee/mcp-prompt-injection-scanner"]    }  }}

CLI (CI/CD — e.g. scan a RAG knowledge-base repo on every PR)

bash
npx @guardbee/mcp-prompt-injection-scanner scan ./knowledge-base --fail-on=high --format=sarif > results.sarif

MCP Tools

ToolDescription
scan_textScans a given text/document snippet
scan_fileScans a single file
scan_directoryRecursively scans a directory (e.g. a RAG knowledge base) (node_modules, .git, dist skipped automatically)
list_patternsLists all supported patterns by category

Detected Patterns

CategoryPatternSeverityWhat it means
instruction-overrideinstruction_override_phrasehighA classic override phrase like "ignore/disregard/forget previous instructions"
instruction-overrideinstruction_override_trhighThe Turkish form: "önceki talimatları yok say / unut / görmezden gel"
instruction-overridedan_modehighAsks for the "DAN mode" jailbreak persona
instruction-overridebypass_safetyhighTells the model to bypass or disable its safety measures / guardrails
role-spoofingsystem_role_spoofmediumA fake "System:" role label at the start of a line in the content
role-spoofingchat_template_marker_injectionhighRaw chat-template control tokens (<|im_start|>, [INST]) in the content
role-spoofingsystem_taghighA <system> tag that tries to pass data off as a system message
hidden-texthidden_zero_width_charsmediumZero-width space/word-joiner (U+200B/U+2060) — text hidden from a human reviewer
hidden-textunicode_tag_smugglingcriticalInvisible Unicode tag characters (U+E0000–E007F) carrying hidden text; flag emoji such as 🏴󠁧󠁢󠁥󠁮󠁧󠁿 are excluded
hidden-textbidi_control_charsmediumBidi override/isolate characters that make text display in a different order than it is read
hidden-textcss_hidden_text_with_instructionhighA display:none/white-on-white element containing instruction-like language
hidden-texthtml_comment_instructionhighAn HTML comment containing instruction-like language
direct-addressdirect_address_to_aimediumThe content directly addresses "the AI"/"the assistant"
exfiltrationexfiltration_url_template_in_imagehighA markdown image URL with a {{...}}/${...} template — a data-exfil beacon
exfiltrationreveal_system_prompt_requesthighA sentence asking the model to reveal its system prompt
exfiltrationreveal_system_prompt_trhighThe Turkish form: "sistem istemini göster"
exfiltrationsend_data_to_url_instructioncriticalAn explicit instruction ordering the model to send data to an external URL

These are heuristic findings — a static text-pattern scan, not a semantic/intent analysis. Designed for a low false-positive rate (e.g. emoji ZWJ sequences and ordinary display:none modals are specifically excluded), but every finding should still be reviewed manually.

LLM judge (optional)

The patterns know attack phrases; a paraphrased, indirect or translated instruction slips past them. --judge also has a model read each file, in chunks, and reports instructions aimed at an agent as judge_semantic_injection (high). The finding carries judge: { model, version, confidence }, also in SARIF properties. The judge only adds findings.

bash
GUARDBEE_JUDGE_URL=http://127.0.0.1:11434/v1 GUARDBEE_JUDGE_MODEL=qwen2.5:7b \  npx @guardbee/mcp-prompt-injection-scanner scan ./docs --judge

It is off unless configured. Since the content goes to the endpoint, a non-local one needs --judge-allow-remote and https. On GuardBee's judge benchmark (50 English and Turkish samples), the patterns catch 16% of the attacks and qwen2.5:7b all of them, with no false positives.

Configuration (guardbee.yml)

yaml
prompt-injection-scanner:  fail-on: high       # any | critical | high | medium | low | none  max-files: 5000  exclude:    - ".test.ts"    - "fixtures/"

Development

bash
npm run buildnpm test             # 45 unit tests

License

MIT — GuardBee

Feedback

Questions, ideas, or a false positive? Start a thread in GitHub Discussions or open an issue. If GuardBee is useful to you, a ⭐ on the repository helps others find it.

Source: packages/prompt-injection-scanner/README.md at commit 952a0bf

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

3
  1. v0.2.2LatestOct 2, 2026
  2. v0.2.1Sep 30, 2026
  3. v0.1.4Sep 29, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts