Prompt Injection Scanner

@guardbee/mcp-prompt-injection-scanner

🇬🇧 English | 🇹🇷 Türkçe | 🇨🇳 中文 | 🇯🇵 日本語 | 🇰🇷 한국어 | 🇧🇷 Português | 🇪🇸 Español | 🇩🇪 Deutsch

[npm version] [npm downloads] [License: MIT]

An MCP (Model Context Protocol) server that scans content — a RAG chunk, a scraped web page, a document — for indirect prompt injection payloads.

ai-code-scanner and mcp-server-auditor scan code; this package scans data. In classic prompt injection, the attacker writes a malicious prompt themselves; in indirect prompt injection, the attacker never talks to the model at all — instead they embed instructions in a document, web page, or tool result the model will later read. The moment the model pulls this content into its context via a RAG retrieval or a web fetch, the embedded instruction appears to carry the same authority as the user's own instructions.

Telemetry is off by default. With GUARDBEE_TELEMETRY=1 it sends the server, tool, success, duration and short parameter values such as a file path; longer strings and fields like content, token or password are replaced with a placeholder. See @guardbee/mcp-telemetry.

Web page/RAG document ──► prompt-injection-scanner ──► LLM context              │              ├─ Instruction override   ("ignore all previous instructions", "önceki talimatları yok say")              ├─ Role spoofing          ("System:", <|im_start|>, [INST], <system>)              ├─ Hidden text            (zero-width, Unicode tag and bidi characters, display:none + instruction, HTML comment)              ├─ Direct address         ("Dear AI, ...")              └─ Exfiltration           (system prompt extraction request, data → URL instruction, templated img beacon)

Features

• 17 patterns, 5 categories — instruction-override, role-spoofing, hidden-text, direct-address, exfiltration. English and Turkish phrasing
• The rules live in @guardbee/guard-core, shared with @guardbee/mcp-security-proxy, so a phrase this scanner reports is the same phrase the proxy blocks at runtime
• Every finding includes why it's risky and what to do about it (recommendation) — not just "found it"
• SARIF 2.1.0 output — CI/CD integration (e.g. auto-scanning a knowledge-base repo on every PR)
• Config file support via guardbee.yml
• 45 unit tests — a positive and a negative (false-positive) scenario for every pattern; known false-positive sources like emoji ZWJ sequences and ordinary display:none modals are specifically tested

Quick Start

Claude Desktop / MCP Client

{  "mcpServers": {    "guardbee-prompt-injection-scanner": {      "command": "npx",      "args": ["-y", "@guardbee/mcp-prompt-injection-scanner"]    }  }}

CLI (CI/CD — e.g. scan a RAG knowledge-base repo on every PR)

npx @guardbee/mcp-prompt-injection-scanner scan ./knowledge-base --fail-on=high --format=sarif > results.sarif

MCP Tools

Detected Patterns

These are heuristic findings — a static text-pattern scan, not a semantic/intent analysis. Designed for a low false-positive rate (e.g. emoji ZWJ sequences and ordinary display:none modals are specifically excluded), but every finding should still be reviewed manually.

LLM judge (optional)

The patterns know attack phrases; a paraphrased, indirect or translated instruction slips past them. --judge also has a model read each file, in chunks, and reports instructions aimed at an agent as judge_semantic_injection (high). The finding carries judge: { model, version, confidence }, also in SARIF properties. The judge only adds findings.

GUARDBEE_JUDGE_URL=http://127.0.0.1:11434/v1 GUARDBEE_JUDGE_MODEL=qwen2.5:7b \  npx @guardbee/mcp-prompt-injection-scanner scan ./docs --judge

It is off unless configured. Since the content goes to the endpoint, a non-local one needs --judge-allow-remote and https. On GuardBee's judge benchmark (50 English and Turkish samples), the patterns catch 16% of the attacks and qwen2.5:7b all of them, with no false positives.

Configuration (guardbee.yml)

prompt-injection-scanner:  fail-on: high       # any | critical | high | medium | low | none  max-files: 5000  exclude:    - ".test.ts"    - "fixtures/"

Development

npm run buildnpm test             # 45 unit tests

License

MIT — GuardBee

Feedback

Questions, ideas, or a false positive? Start a thread in GitHub Discussions or open an issue. If GuardBee is useful to you, a ⭐ on the repository helps others find it.