Injectshield
Scan untrusted user or tool-provided text for prompt-injection patterns before your agent forwards it to the model.
Overview
InjectShield is an MCP server for the Ship phase that scans untrusted text for prompt-injection risk before your agent sends it to an LLM.
What is this MCP server?
- Prompt-injection firewall that scans untrusted text before LLM calls
- stdio npm package @injectshield/mcp (server version 0.1.4)
- Hosted API default https://api.injectshield.dev with free tier 10,000 requests per month
- INJECTSHIELD_API_BASE override for self-hosted deployments
- Fits agent loops that fetch external content or accept end-user prompts
- Package and server version 0.1.4
- Free tier: 10,000 requests per month (per env description)
- Default API base https://api.injectshield.dev
What problem does it solve?
Agents that read emails, web pages, or user files can be hijacked by hidden instructions embedded in untrusted content.
Who is it for?
Indie builders launching customer-facing or web-connected agents who need a simple injection scan on the MCP tool path.
Skip if: Internal-only agents with zero external input, or teams that already run a full enterprise AI gateway with equivalent policies.
What do I get? / Deliverables
After adding @injectshield/mcp, you block or flag risky text in the agent loop before it reaches the model, using the injectshield.dev API or your self-hosted base URL.
- MCP-accessible injection scans on arbitrary untrusted text
- Configurable API endpoint for cloud or self-hosted policy execution
- Safer agent pipelines before production user traffic
Recommended MCP Servers
Journey fit
Injection risk spikes when you ship agents that ingest web pages, tickets, or user uploads—Ship security is the canonical home for guardrails before production exposure. security subphase covers hardening agent pipelines; InjectShield is a dedicated pre-LLM scan step in that chain.
How it compares
Pre-LLM injection scanner via MCP, not a credentials vault or general content moderation marketplace.
Common Questions / FAQ
Who is InjectShield for?
Solo builders shipping agents that consume user-generated or web-sourced text and want a lightweight injection check wired through MCP.
When should I use InjectShield?
Use it in Ship-phase security hardening whenever untrusted strings flow into your agent or LLM—especially before launch or when adding new data sources.
How do I add InjectShield to my agent?
Install npm stdio package @injectshield/mcp, set INJECTSHIELD_API_KEY from injectshield.dev, optionally INJECTSHIELD_API_BASE for self-hosting, then register the server in your MCP client.