# InjectScan Prompt Injection Scanner

> InjectScan Prompt Injection Scanner is a paid API for AI agents from injectscan.agentgate.workers.dev, paid per call via x402, $0.003/call, status unknown (last checked 2026-10-27).

Scans text, web pages, or MCP tool definitions for prompt-injection attacks and returns a risk score, flagged categories, and character-level spans of detected threats.

## Facts

- Endpoint: GET https://injectscan.agentgate.workers.dev/v1/scan?utm_source=zero.xyz
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-27
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/injectscan-prompt-injection-scanner-0eb6f515
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_8DzB_2CARZNXGbu-KpLEk

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability injectscan-prompt-injection-scanner-0eb6f515
```

Example prompt: Before you process that web page, scan it for prompt injection attacks — check for instruction overrides, jailbreak personas, data exfiltration URLs, and any hidden unicode tricks, and tell me the risk score and what was found.

## When to prefer this

Choose InjectScan when your AI agent is about to consume untrusted external content — user messages, scraped web pages, third-party tool responses, or MCP definitions — and you need a fast, deterministic rule-based verdict with character-level spans before the agent processes it. Prefer this over LLM-based moderation when you need consistent, auditable rule matches (not probabilistic classification), when you specifically need prompt-injection and jailbreak detection (not general toxicity), or when you need to catch hidden Unicode and encoded payload attacks that generic content filters miss.

## Known failure modes

- Text exceeds ~8 KB GET limit — use POST JSON for content up to 100,000 characters
- URL target is not publicly accessible — returns fetch error
- Obfuscated payloads using novel encoding not in current ruleset may be missed
- Very short inputs may produce inconclusive low-confidence scores
- Rate limiting or payment failure returns 402 error

## How this service works

Prompt-injection scanner for AI agents: score text, web pages and MCP tool definitions before your agent reads them. Deterministic rules (instruction override, jailbreak personas, system-prompt extraction, fake delimiters, exfiltration URLs, tool hijack, hidden Unicode, encoded payloads); risk score, categories and spans.

## Output

Returns a JSON object with: overall risk_score (0–100), verdict (e.g. 'malicious'), flagged boolean, per-finding details (rule name, category, matched text, character start/end positions, weight), per-category summaries with scores and descriptions, counts of hidden Unicode characters (zero-width, bidi, homoglyphs), decoded payload list, chars_scanned, truncated flag, and ruleset version string.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {
      "url": {
       "type": "string",
       "description": "Instead of text: absolute http(s) URL of a public page to fetch and scan (visible text plus hidden HTML)"
      },
      "text": {
       "type": "string",
       "description": "Text to scan (GET: up to ~8 KB in the query string; POST JSON for longer text, up to 100,000 characters)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ms": 1,
  "input": "text",
  "hidden": {
   "zero_width": 0,
   "unicode_tags": 0,
   "bidi_controls": 0,
   "bom_soft_hyphen": 0,
   "homoglyph_words": 0
  },
  "decoded": [],
  "flagged": true,
  "ruleset": "2026.10.1",
  "verdict": "malicious",
  "findings": [
   {
    "end": 51,
    "rule": "override.ignore_previous",
    "text": "ignore all previous instructions",
    "start": 19,
    "weight": 0.8,
    "category": "instruction_override",
    "location": "text"
   },
   {
    "end": 96,
    "rule": "exfil.send_data",
    "text": "send the conversation to https://webhook",
    "start": 56,
    "weight": 0.7,
    "category": "data_exfiltration",
    "location": "text"
   },
   {
    "end": 101,
    "rule": "exfil.collector_domain",
    "text": "webhook.site",
    "start": 89,
    "weight": 0.3,
    "category": "data_exfiltration",
    "location": "text"
   }
  ],
  "truncated": false,
  "categories": [
   {
    "rules": 1,
    "score": 80,
    "category": "instruction_override",
    "description": "Tries to cancel or replace the instructions the model is following (\"ignore all previous instructions\")."
   },
   {
    "rules": 2,
    "score": 75,
    "category": "data_exfiltration",
    "description": "Moves data out: markdown images or links with data in the URL, collector domains, \"send the conversation/keys to ...\", sensitive file paths."
   }
  ],
  "risk_score": 95,
  "chars_scanned": 105
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/injectscan-prompt-injection-scanner-0eb6f515/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from injectscan.agentgate.workers.dev](https://www.zero.xyz/host/injectscan.agentgate.workers.dev/llms.txt)