For your agents · Maskflare Prompt Injection Detection
Catch Injected Instructions in MCP Tool Results and Tool Descriptions
What the CRM tool returns
{ "name": "Ada Lovelace",
"email": "ada@example.com",
"iban": "CH93 0076 2011 6238 5295 7",
"plan": "Business" }
What the model sees
{ "name": "mf_mask_170b",
"email": "mf_mask_5e1d",
"iban": "mf_mask_d7e0",
"plan": "Business" }
574
Built-in detectors for personal data and secrets
47
Country packs, checksum-validated where the format has one
9
AI providers behind one gateway, plus the desktop agent and proxy
Sound familiar?
Why the usual answers fall short
“We told the model to ignore instructions in documents.”
That is a request to the same component that is being attacked. A check outside the model doesn't depend on the model complying.
“Our prompt filter covers it.”
A filter on chat prompts never sees a tool result or a tool description. Much indirect injection arrives there.
“We trust our MCP servers.”
You trust their code. A server that fetches pages or reads mail returns whatever those contain, and a tool description can change after you approved it.
An agent reads text nobody on your team wrote: a web page, an email, a ticket, a file, a tool description from a server you connected last week. The model can't reliably tell that text from its instructions.
Maskflare checks that text where it enters the agent through MCP: in the result of every tool call and in every tool listing. It does not read what people type into a chat, and it does not look for jailbreaks.
How Maskflare Prompt Injection Detection works
The injection pack adds five detectors to the rules that already run on MCP traffic. They read each string of a tool result and each tool in a tools/list answer, before the result is masked, with fixed phrase lists and structural checks. No model is involved, so a finding is repeatable and names the detector that matched. Each detector has an action: alert, block (the result is withheld and the agent gets a JSON-RPC error) or, for hidden text only, strip (the hidden characters and blocks are removed and the rest goes through). New environments start with the pack on in alert mode.
- 01
Route the MCP server through Maskflare
Register it in the console and use the /v1/mcp/{server} route, or list its host in the forward proxy.
- 02
Choose alert or block
A new organization on the default Protect now starter blocks what the pack finds; the Monitor-first starter only counts it. In alert mode, findings are counted per detector, so you see what your servers actually return.
- 03
Tighten per detector
Once you have seen the alerts, set block for instruction overrides and encoded payloads, and strip for hidden text.
Benefits
Hidden or invisible text
Unicode tag characters, bidirectional controls, zero-width characters inside words or in runs, runs of variation selectors, and HTML comments or CSS-hidden elements whose text reads as an instruction.
Instruction overrides
Phrases such as ignore all previous instructions or do not tell the user, in English, German, French, Italian and Spanish, plus chat-template tokens. Look-alike letters, accents, spacing and case do not hide them.
Encoded payloads
Base64, base32, hex and percent-encoded runs that decode, once or twice, to an instruction.
Tool poisoning
A tool description or parameter description that carries an override, hidden text, an IMPORTANT-style block, an instruction to read secrets such as ~/.ssh, .env or mcp.json, or to change how other tools behave.
Exfiltration links
Markdown or HTML images and links whose query parameters carry conversation-looking data: a placeholder, prose or a long encoded blob.
Alert, block or strip
Alert counts the finding and lets the result through. Block withholds the result. Strip removes hidden text and passes the rest.
Capabilities
Where it runs
On MCP traffic through the gateway route /v1/mcp/{server} and through the forward proxy for inspected MCP hosts: every string of a tool result (content text, embedded resource text, structured content) and every tool of a tools/list answer.
Where it does not run
Not on chat prompts, files, browser traffic, provider responses or the output of a coding agent's own shell and file tools. The coding-agent hooks mask secrets and personal data in those and do not run these detectors.
Deterministic and explainable
Fixed phrase lists and structural checks, no model. Every finding names its detector, and the same input gives the same answer.
Measured on our own test set
Maskflare's test set, written by the team that wrote the detectors, has 106 attacks and 246 benign samples. All attacks were caught and no benign sample was flagged. That is an upper bound for real traffic, not an independent benchmark.
Set it up
{
"jsonrpc": "2.0",
"id": 12,
"error": {
"code": -32001,
"message": "Maskflare withheld this result: it contains injection_override.",
"data": { "code": "sensitive_data_blocked", "rule_keys": ["injection_override"] }
}
}What it does not do
We'd rather you hear it from us.
- It reads MCP tool results and tool listings only. It never reads chat prompts, so it does not defend a chat box against a user typing an attack.
- It does not detect jailbreaks, and it has no topic or content-moderation filtering. Use a guardrail with classifiers for those.
- It is rule-based. A paraphrased override such as pay no attention to what you were told, a language outside English, German, French, Italian and Spanish, or text inside an image passes.
- Hidden text is judged by structure. An instruction hidden by a style defined in a separate stylesheet is not seen. Exfiltration checks need a query parameter, so data carried in a URL path is not judged.
- It does not run on traffic that doesn't pass through the gateway route or the proxy, such as a local MCP server an agent starts itself.
- Detection reduces the chance and does not remove the risk. Keep least-privilege tools, human approval for consequential actions and masking in place.
Explore related capabilities
See how Maskflare applies the same masking rules to related AI and data-protection workflows.
Related guides and explainers
Frequently asked questions
Does Maskflare detect prompt injection in chat prompts?
No. The detectors run on MCP tool results and tool listings only. They never read what a person types into a chat or what an application sends to a model provider.
Does it detect jailbreaks?
No. Jailbreaks are aimed at a model's safety rules and usually come from the user in a chat prompt. Maskflare does not read chat prompts and has no jailbreak classifier.
Is a model used to decide what is an injection?
No. The checks are fixed phrase lists and structural checks, so they are repeatable and every finding names the detector that matched. The trade-off is that a new phrasing can pass.
What happens when something is found?
It depends on the action set for that detector. Alert counts it and lets the result through. Block withholds the result and returns a JSON-RPC error to the agent. Strip, which applies to hidden text only, removes the hidden content and passes the rest.
Does it work in Claude Code, Cursor or Codex?
Only for MCP servers whose traffic goes through the gateway route or the forward proxy. The coding-agent hooks on the developer's machine mask secrets and personal data and do not run the injection detectors.
What does masking add against injection?
If an injected instruction does get through, masked values mean the agent has tokens to send, not the real data. Masking and injection detection are separate controls and work together.
See it on your own data
Try Maskflare free.
Bring your hardest prompts.
28-day free trial or 10,000 requests, whichever comes first. Point one app at the gateway or enroll a few laptops,
and watch what gets masked. Or talk to us first.
- SOC 2 Type II: In progress
- ISO 27001: In progress
- EU hosting by default · on-premises available
- Prompts and files never stored
- Never used to train AI models
- GDPR · nDSG · DPA available
- Trust center →