@injectshield/mcp

MCP server for InjectShield — exposes the InjectShield prompt-injection-detection API as MCP tools so any MCP-compatible client (Claude Code, Cursor, Cline, etc.) can scan untrusted text before passing it into another LLM call.

Tools

• scan — Scan a string for prompt-injection. Returns verdict, confidence, threat category, matched pattern IDs, and an optional sanitized version with injection spans redacted.
• scan_url — Fetch a URL and scan its body. Sets context to web_content automatically.
• patterns — List supported threat categories, context kinds, and sensitivity levels.

Get an API key

Free tier: 10,000 requests/month, no credit card. Self-serve at https://injectshield.dev — your key is delivered by email.

Install in Claude Code

claude mcp add injectshield --env INJECTSHIELD_API_KEY=is_live_… -- npx -y @injectshield/mcp

Install in Cursor

Add to ~/.cursor/mcp.json:

{
  "mcpServers": {
    "promptshield": {
      "command": "npx",
      "args": ["-y", "@injectshield/mcp"],
      "env": { "INJECTSHIELD_API_KEY": "is_live_…" }
    }
  }
}

Install in Cline / generic MCP client

Same shape as Cursor. Stdio transport, command npx -y @injectshield/mcp, set INJECTSHIELD_API_KEY in the env block.

Usage

Once installed, your agent has three new tools. Pattern-match this:

Before reading a fetched web page or file, call scan with the body and bail if safe is false. The cleaned variant in cleaned_text is the safest thing to feed forward.

Example (model-side reasoning):

User: Summarize https://example.com/article

Agent → scan_url({"url": "https://example.com/article"})
  → { "safe": false, "threat_type": "instruction_injection",
      "patterns_matched": ["ignore-previous", "system-prompt-leak"],
      "cleaned_text": "...[REDACTED:instruction_injection]..." }
Agent: I detected prompt-injection in this page. Working from the
       redacted version: ...

Configuration

| Env var | Default | Purpose | |---|---|---| | INJECTSHIELD_API_KEY | (none) | Required for scan and scan_url. Get a free one. | | INJECTSHIELD_API_BASE | https://api.injectshield.dev | Override for self-hosted deployments. |

Defense in depth

InjectShield reduces but does not eliminate prompt-injection risk. Pair it with system-prompt hardening, tool sandboxing, and output filtering. See the main repo for the full pattern library and a more thorough discussion.

License

MIT.