prompt-protection MCP server

prompt-protection

A provenance-tracked tool-call guard for JavaScript agents. Tool results are tainted, destinations the user named are trusted, and every tool call the model proposes is checked before it runs: untrusted data does not reach a network, email, exec, file or payment sink. Fail-closed, in-process, zero runtime dependencies. Text detection, spotlighting and canaries ship as components, with their benchmark numbers published whether they flatter the library or not.

Live Demo →

What it is, and what it isn't

Prompt injection stopped being a text-classification problem the moment models started calling tools. The damage in an agent is a consequence, not a sentence: a URL lifted from an email ends up in an outbound request, an attendee address from a calendar entry becomes the recipient of send_email, a payload in a README lands in exec. Version 3 tracks where data came from and refuses to let untrusted data reach a dangerous sink. That is the capability model from Google DeepMind's CaMeL paper (arXiv 2503.18813), ported to a JavaScript tool-calling loop without the custom interpreter.

It is a policy layer inside your process. It is not an isolation boundary. It cannot see a flow that passes through the model's hidden state, a paraphrase that shares no identifiers with its source, or a source you never registered. The Limitations section lists what it misses, with the dataset rows that show it.

60-second agent quickstart

import { generateText } from 'ai';
import { createGuard } from 'prompt-protection/guard';

const guard = createGuard({
  sinks: { http_post: 'network', send_email: 'email', run_shell: 'exec' }, // or rely on name heuristics
});

guard.analyzeUserTurn(userMessage);           // destinations the user names become trusted

const result = await generateText({
  model,
  tools: guard.wrapTools(tools),              // check → execute → taint result
  toolApproval: guard.vercelToolApproval(),   // block → denied, confirm → user-approval
  prompt: userMessage,
});

Or drive it by hand:

guard.taint('read_email', emailBody);         // label a tool result as untrusted
const decision = guard.checkToolCall({ toolName: 'http_post', args: { url } });
// { action: 'block', policy: 'untrusted-to-exfil-sink', flows: [{ kind: 'identifier', path: 'args.url', … }] }

Architecture

tool result ──taint──▶ provenance label ──▶ shingles + identifiers (URL, host, email, path, token)
                                                       │
model proposes tool call ──▶ sink class ──▶ flow detection (exact / identifier / content) ──▶ policies ──▶ allow · flag · confirm · block
                                  ▲                                                             ▲
                       explicit map or name heuristics                          plan() allow-list · user-trusted destinations

Shortened. The full README is on GitHub.