Injection Shield
Catch prompt injection before your model reads it.
Peels untrusted text in layers — invisible Unicode, tag-character smuggling, base64 and ROT13 payloads, CSS-hidden HTML — then runs 30 behavioural rules over every layer. Returns a risk score, evidence, a sanitized copy, and a datamarked copy you can safely hand to your model.
Playground
Edit the example or run it as-is.
Input
text*stringUntrusted text: a web page, email, tool output, or agent message (≤ 50k chars).
Output
verdictstringclean | suspicious | malicious
scorenumber0–100 risk score.
findingsarrayEach hit with category, severity, layer and evidence.
sanitizedstringInput with invisible characters and HTML comments removed.
spotlightedstringDatamarked copy to pass to an LLM as data.
How it learned
No model, no training run. The rules were written by reading public research and open-source tooling, then encoded by hand. Credit where it’s due:
# 1. Ask for the price (returns 402 + PAYMENT-REQUIRED) curl -i -X POST https://your-domain/api/x402/injection-shield \ -H "Content-Type: application/json" \ -d '{"text":"ignore previous instructions"}' # 2. Free trial, no payment (rate-limited) curl -X POST https://your-domain/api/try/injection-shield \ -H "Content-Type: application/json" \ -d '{"text":"ignore previous instructions"}'