{“@context”: “https://schema.org”, “@type”: “FAQPage”, “mainEntity”: [{“@type”: “Question”, “name”: “Vs AI Code Scanner?”, “acceptedAnswer”: {“@type”: “Answer”, “text”: “AI Code Scanner scans code; Prompt Injection Scanner scans the data/documents the model will read.”}}, {“@type”: “Question”, “name”: “False positives?”, “acceptedAnswer”: {“@type”: “Answer”, “text”: “Known FP sources are tested — still review findings manually.”}}, {“@type”: “Question”, “name”: “API key?”, “acceptedAnswer”: {“@type”: “Answer”, “text”: “No — fully local/filesystem.”}}]}

MCP guide · Prompt Injection Scanner

MCP Prompt Injection Scanner: defend RAG and content — @guardbee/mcp-prompt-injection-scanner

@guardbee/mcp-prompt-injection-scanner scans content, not code: a RAG chunk, scraped page, or document. In classic prompt injection the attacker talks to the model; in indirect injection they embed instructions in data the model later reads via RAG or fetch — and those instructions can look as authoritative as the user’s.

What does it do?

It finds phrases like “ignore previous instructions”, spoofed System: roles, chat-template markers (<|im_start|>, [INST]), zero-width hidden text, display:none + instructions, HTML-comment commands, “Dear AI” addresses, and exfiltration patterns (reveal system prompt, templated img beacons, send-data-to-URL).

Who is it for?

RAG / knowledge-base product teams
Apps that put scraped pages or tool results into LLM context
DevSecOps scanning document repos on every PR
Developers who want this check inside Claude or Cursor

What it is not

Source-code / MCP-tool SAST (use AI Code Scanner or Server Auditor)
Replacing a runtime WAF that blocks every LLM call
A full semantic jailbreak model (heuristic text patterns)

Features

Feature	Description
10 patterns / 5 categories	instruction-override, role-spoofing, hidden-text, direct-address, exfiltration
Recommendations	Why it’s risky and what to do
SARIF 2.1.0	For knowledge-base CI gates
guardbee.yml	fail-on, max-files, exclude rules
FP-aware	Emoji ZWJ and ordinary display:none modals are tested

MCP tools

Tool	Description
`scan_text`	Scan a text/document snippet
`scan_file`	Single file
`scan_directory`	Directory / knowledge base (skips node_modules, .git, dist)
`list_patterns`	List supported patterns

Install with npm

Global install (handy for Claude Desktop / Cursor):

bash

npm install -g @guardbee/mcp-prompt-injection-scanner

or via npx (recommended with -y in config):

bash

npx -y @guardbee/mcp-prompt-injection-scanner

npm: @guardbee/mcp-prompt-injection-scanner

CLI: npx @guardbee/mcp-prompt-injection-scanner scan ./knowledge-base --fail-on=high --format=sarif > results.sarif. Opt out of telemetry with GUARDBEE_TELEMETRY=0.

Claude Desktop configuration

Config file paths:

macOS~/Library/Application Support/Claude/claude_desktop_config.json
Windows%APPDATA%\Claude\claude_desktop_config.json
Linux~/.config/Claude/claude_desktop_config.json

Merge this block, then restart Claude Desktop:

claude_desktop_config.json

{
  "mcpServers": {
    "guardbee-prompt-injection-scanner": {
      "command": "npx",
      "args": [
        "-y",
        "@guardbee/mcp-prompt-injection-scanner"
      ]
    }
  }
}

Cursor and other MCP clients

In Cursor, add the same command / args / env under Settings → MCP. stdio MCP servers use the same contract as Claude Desktop.

Example prompts in Claude

“Scan this knowledge-base folder for prompt injection: ./docs”
“Does this scraped HTML hide instructions?”
“Which patterns do you support? list_patterns”

See surface risk with Guardbee

MCP servers speed up security work in chat. Start a 14-day free trial for brand scans and BeeAI.

Start free MCP servers

Frequently asked questions

Vs AI Code Scanner?

AI Code Scanner scans code; Prompt Injection Scanner scans the data/documents the model will read.

False positives?

Known FP sources are tested — still review findings manually.

API key?

No — fully local/filesystem.

MCP Prompt Injection Scanner: defend RAG and content