Injectshield

io.github.bch1212Published by GitHub account bch1212v0.1.4Updated Oct 25, 2026

Prompt-injection firewall for AI agents — scan untrusted text before LLM calls.

VerifiedSTDIODesktop onlyWeb Search & ScrapingSecurity & Monitoring

Overview

AI-generated overview

A local MCP server that exposes the InjectShield prompt-injection detection API so an assistant can scan untrusted text or web pages before passing them to anLL

What you can do
Scan a string for prompt-injection and get a verdict, confidence, threat category, matched pattern IDs and an optional sanitized version with injection spans redacted. Fetch a URL and scan its body, automatically treating it as web content. List supported threat categories, context kinds and sensitivity levels.
When to use it
Useful when an assistant ingests untrusted text, fetched web pages or files and you want a check for prompt-injection before feeding that content into another LLM call. It is a supporting layer, not a replacement for other defenses.
Requirements
Runs as a local stdio process via npx from the npm package @injectshield/mcp, so Node.js is needed. Requires an API key in the INJECTSHIELD_API_KEY environment variable, obtained from the vendor's site (free tier listed at 10K requests/month). INJECTSHIELD_API_BASE can override the API base URL for self-hosted deployments. Network access to the InjectShield API.
Before you install
The scanned text and fetched URL bodies are sent to the InjectShield API, a third party, so do not scan secrets or private content you would not share. The API key is a credential passed in the environment; keep it out of shared configs. The vendor states it reduces but does not eliminate prompt-injection risk, so pair it with other defenses. Scanning consumes API quota.

Installation

In SourceWeft

  1. Open Injectshield in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@injectshield/mcp

MCP server for InjectShield — exposes the InjectShield prompt-injection-detection API as MCP tools so any MCP-compatible client (Claude Code, Cursor, Cline, etc.) can scan untrusted text before passing it into another LLM call.

Tools

  • scan — Scan a string for prompt-injection. Returns verdict, confidence, threat category, matched pattern IDs, and an optional sanitized version with injection spans redacted.
  • scan_url — Fetch a URL and scan its body. Sets context to web_content automatically.
  • patterns — List supported threat categories, context kinds, and sensitivity levels.

Get an API key

Free tier: 10,000 requests/month, no credit card. Self-serve at https://injectshield.dev — your key is delivered by email.

Install in Claude Code

bash
claude mcp add injectshield --env INJECTSHIELD_API_KEY=is_live_… -- npx -y @injectshield/mcp

Install in Cursor

Add to ~/.cursor/mcp.json:

jsonc
{  "mcpServers": {    "promptshield": {      "command": "npx",      "args": ["-y", "@injectshield/mcp"],      "env": { "INJECTSHIELD_API_KEY": "is_live_…" }    }  }}

Install in Cline / generic MCP client

Same shape as Cursor. Stdio transport, command npx -y @injectshield/mcp, set INJECTSHIELD_API_KEY in the env block.

Usage

Once installed, your agent has three new tools. Pattern-match this:

Before reading a fetched web page or file, call scan with the body and bail if safe is false. The cleaned variant in cleaned_text is the safest thing to feed forward.

Example (model-side reasoning):

User: Summarize https://example.com/article
Agent → scan_url({"url": "https://example.com/article"})  → { "safe": false, "threat_type": "instruction_injection",      "patterns_matched": ["ignore-previous", "system-prompt-leak"],      "cleaned_text": "...[REDACTED:instruction_injection]..." }Agent: I detected prompt-injection in this page. Working from the       redacted version: ...

Configuration

Env varDefaultPurpose
INJECTSHIELD_API_KEY(none)Required for scan and scan_url. Get a free one.
INJECTSHIELD_API_BASEhttps://api.injectshield.devOverride for self-hosted deployments.

Defense in depth

InjectShield reduces but does not eliminate prompt-injection risk. Pair it with system-prompt hardening, tool sandboxing, and output filtering. See the main repo for the full pattern library and a more thorough discussion.

License

MIT.

Source: packages/injectshield-mcp/README.md at commit ec8eb5b

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.4LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts