
GenPark Prompt Injection Canary Leak Sentinel
io.github.alphaparkincPublished by GitHub account alphaparkincv1.0.1Updated Nov 2, 2026
HMAC-signed zero-width invisible canary token generator and output response leak auditor
Overview
Generates HMAC-signed zero-width invisible canary tokens and audits model output for leaked canaries, as a local Python MCP server.
- What you can do
- Create HMAC-signed canary tokens that are invisible zero-width characters.
- Audit model output responses to detect whether canary tokens leaked.
- Support LLM guardrail checks around prompt injection and data leakage.
- Run locally as a Python standard-library script with no third-party dependencies.
- When to use it
- Useful when you want to test or monitor an LLM pipeline for prompt-injection-driven leakage by planting invisible canary tokens and checking whether they surface in responses.
- Requirements
- A local Python 3 runtime; the README configures it as a stdio server launched with python mcp_server.py. No environment variables, headers or authentication are declared.
Installation
In SourceWeft
- Open GenPark Prompt Injection Canary Leak Sentinel in the dashboard and add it to a workspace.
- Enable the server for the chats that should use its tools.
Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.
Other MCP clients
Follow the launch instructions in the repository.
README
genpark-prompt-injection-canary-leak-sentinel-skill
[Verified by Smithery] [LinkedIn] [Website]
HMAC-signed zero-width invisible canary token generator and output response leak auditor for LLM guardrails
Quick Installation & MCP Integration
Add to your Claude Desktop or Cursor configuration:
Zero Dependencies
Implemented entirely in Python 3 standard library.
Source: README.md at commit 02f1603
Tools
0Version history
1- v1.0.1LatestOct 19, 2026
Score
40% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
- Reached in the last 30 days25 pts
Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.
- Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
- Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
- DescriptionRequired15 pts
- Logo10 pts
- Documentation15 pts
- License10 pts
Declare a license in the repository or the registry entry.