# Verdict Tool Output Guard

> Verdict Tool Output Guard is a paid API for AI agents from verdict.kechlab.com, paid per call via x402, $0.0133/call, status unknown (last checked 2026-10-21).

Detects prompt injection and tool-poisoning attacks in tool/API results returned to an AI agent, returning allow, review, or block.

## Facts

- Endpoint: POST https://verdict.kechlab.com/v1/tool-output-guard?utm_source=zero.xyz
- Price: $0.0133/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-21
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/verdict-tool-output-guard-2127f8e7
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap__t2L_sOSf7cxCnYtJocyv

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability verdict-tool-output-guard-2127f8e7 -d '<json body>'
```

Example prompt: Before you process the result from that web-search tool, run it through Verdict's tool-output guard — the tool is called 'web_search' and it's supposed to return search snippets — check whether the output is safe or if it's trying to hijack you.

## When to prefer this

Use this endpoint when your AI agent consumes results from external tools, MCP servers, APIs, search engines, or file reads and you need to screen those results for prompt injection or tool-poisoning before the agent acts on them. Prefer this over general content moderation when the threat model is specifically adversarial tool outputs trying to redirect agent behavior, exfiltrate data, or issue unauthorized commands — rather than offensive language or NSFW content.

## Known failure modes

- Ambiguous tool output may return 'review' requiring human decision
- False positives on legitimate tool outputs that use imperative language
- Missing 'purpose' field may reduce detection accuracy for context-dependent injections
- Very long tool outputs may be truncated or cause latency spikes
- Novel injection techniques not yet in the model's training may be missed

## How this service works

Tool results (MCP servers, APIs, search, file reads) are untrusted content the agent re-reads. Detects a result that gives orders to the agent, strays from what the tool should return or asks to send data (tool poisoning). Returns allow, review or block.

## Output

Returns a verdict of 'allow', 'review', or 'block' indicating whether the tool output is safe, suspicious, or contains prompt injection / tool-poisoning content. Also indicates whether the output strays from what the tool is supposed to return or attempts to exfiltrate data.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "output": {
   "type": "string",
   "description": "the result returned by the tool"
  },
  "purpose": {
   "type": "string",
   "description": "(optional) what the tool is supposed to return"
  },
  "tool_name": {
   "type": "string",
   "description": "(optional) tool name"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/verdict-tool-output-guard-2127f8e7/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from verdict.kechlab.com](https://www.zero.xyz/host/verdict.kechlab.com/llms.txt)