Injectcheck MCP server

injectcheck

Scan the content your agent is about to read, before your agent reads it.

AI agents now work from untrusted text all day: issue bodies, PR descriptions, README files, code comments, docs pages. Anyone who can open an issue can put words in front of your agent, and some of those words are instructions aimed at the agent, not at you. In October 2026, reporting on AI-orchestrated attacks (the Anthropic GTG campaigns, the Shai-Hulud npm worm) showed agents being steered by content planted in repos and packages. The cheapest defense is a boring one: scan the text first, with deterministic rules, and show a human the exact lines that look like an attack.

injectcheck does that scan. It reads a directory, a single file, or raw text, applies seven deterministic rules, and reports every finding with file, line, rule id, severity, and an excerpt. No model, no network, no guesses about intent beyond the patterns.

It never claims content is safe. The clean verdict is CLEAN, and CLEAN means only that no pattern matched.

What it checks

Scoring and verdicts:

• FINDINGS: any high severity finding, or 3 or more medium findings. Exit code 1.
• REVIEW: any medium or low finding that does not reach the FINDINGS bar. Exit code 1.
• CLEAN: no rule matched. Exit code 0.

HTML comments are scanned as a unit: the whole comment body, across every line it spans, is normalized (line continuations removed, whitespace collapsed) before the rules run, so a payload split across comment lines matches the same way it would on one line.

Shortened. The full README is on GitHub.