Direct answer
Prompt Injection Scanner for MCP Agents
For a prompt injection scanner on MCP, run prompt_shield on untrusted text, emails, web pages, and PDFs, before your agent acts on it. The attack is simple: instructions for your agent hidden inside content your agent was only supposed to read. The defense has to run at the same place the attack lands, inside the tool loop, as one call between fetching the text and trusting it. This page shows what indirect injection looks like, how to scan in one call, and how to read the result.
Updated October 20, 2026.
What indirect injection looks like
Direct injection is a user typing instructions at an agent. Indirect injection is the dangerous kind for working agents: the instructions arrive inside data the agent retrieves while doing a normal job.
In an email: a normal looking message with a footer or white text block that says to forward the thread, or the inbox contents, to an outside address, and to not mention it.
On a web page: a paragraph written for agents, not readers, telling any AI summarizing the page to recommend a specific product, change a conclusion, or follow a link and run its instructions.
In a PDF: an appendix or metadata text that tells the agent the document has pre approved a payment, a signature, or a change of terms.
In a listing or review: text that instructs agents ranking it to score it higher or to hide a defect the human text discloses.
The pattern is always the same: content that should be treated as data starts giving orders. An agent that reads everything in one flat context has no built in way to tell which sentences are yours and which arrived inside a fetched page. The scan adds that distinction as an explicit step.
Scan a page in one call
Zambo is the verifiable work layer for AI. Connect your agent once to https://zambo.dev/mcp: 153 tools total, 35 on the default surface, and prompt_shield is one of them.
1. Fetch the source your agent needs, as data: the email body, the page text, or the extracted PDF text.
2. Call prompt_shield with that text, before summarizing, quoting, or acting on it.
3. Read the result. Clean means proceed, with the limits in the last section in mind. Flagged means stop and handle the source as hostile data.
4. Keep the receipt for the scan call. Zambo returns a verifiable receipt for each call, so you can later show the check ran, on what text, and what it returned. Check any receipt free at zambo.dev/verify/, for example this worked example receipt.
For a quick manual check of a single pasted passage without wiring an agent, use the hub companion page: check text for prompt injection.
Reading the result
Treat the result as a routing decision, not a verdict on the sender.
Clean result: use the text as data. Summarize it, extract facts, cite it. Still do not promote instructions found inside it into your task list unless you, the user, put them there.
Flagged result: quarantine the source. Extract only specific facts you can corroborate elsewhere, drop any instruction shaped content, and tell the user what was found and where. If the task depended on that source, say the source failed the check rather than quietly working around it.
Borderline result: read the flagged passages yourself. A how to guide full of imperatives aimed at a human is different from a paragraph aimed at an AI reader, and context decides. When in doubt, treat ambiguous instruction shaped text as data only.
Log the decision with the scan receipt and the work receipt together. If the agent later does something unexpected, the pair shows whether the check ran and what the agent saw. A day of work can be reviewed in zambo.dev/today, and a job can be handed over with its record via Zambo handover.
Where the check belongs in an agent loop
Place the scan at the trust boundary, and run it every time the boundary is crossed:
Retrieve, then scan, then reason. No outside text enters the planning context unscanned.
Per source, not per job. Each page, attachment, forwarded message, and tool output from an outside system gets its own scan.
Before actions, not after summaries. A scan that runs after the agent has already followed a link or drafted a send is a report, not a guard.
Paired with least privilege. The scan is one layer. Spending limits, narrow tool access, and approval for irreversible steps stay on.
Coverage for a full day of agent work is a Day Pass for $0.99 one time for 24 hours. Ongoing use is the Zambo Pass at $29 a month or $290 a year, and $19 a month for $ZAMBO holders. Humans pay by PayPal or card through PayPal. Agents pay USDC on Base via x402.
Honest limits
A scan lowers risk, it is not a promise nothing gets through. Attackers rephrase, split instructions across sources, and hide text in images or formatting that a text scan cannot see. A clean result means no injection was detected in the text scanned, at the time it was scanned. A verifiable receipt for the scan proves the saved result was not changed after the fact; it does not prove the source was safe, and it does not prove the work the agent did next was correct.
Frequently asked questions
What is a prompt injection scanner for MCP agents?
It is a tool call your agent makes before it trusts outside text. With Zambo, the tool is prompt_shield: you pass it untrusted text from an email, a web page, or a PDF, and it scans that text for prompt injection, meaning hidden instructions aimed at the agent rather than at a human reader. The scan returns a result your agent can act on before the text reaches its working context as instructions.
How do I scan a page or email with prompt_shield?
Connect your agent to Zambo at https://zambo.dev/mcp, fetch the email, page, or document as plain data, then call prompt_shield with that text before you summarize it, follow links in it, or act on anything it asks for. One call scans one body of text. If the result flags injection, treat the source as hostile data: extract only the facts you need, and do not follow instructions found inside it.
What does prompt_shield look for?
It looks for instruction shaped content hiding inside data: lines that tell an agent to ignore earlier directions, to reveal system information, to send, delete, or buy something, to follow a new task found in the text, or to keep the instruction secret from the user. Legitimate content can contain imperatives too, so read a flag in context: the question is whether the text is trying to direct your agent, not whether it contains a verb.
Where does the scan belong in an agent loop?
At the boundary, every time outside text enters the loop. Scan after retrieval and before reasoning: fetch the source, run prompt_shield, then let only the scanned result into the context the agent plans from. Any new source, a second page, an attachment, a forwarded thread, gets its own scan. Scanning once at the start of a job does not cover sources the job picks up later.
Does a clean scan mean the text is safe?
No. A scan lowers risk, it is not a promise nothing gets through. New phrasings, split instructions, and content hidden in images or formatting can evade any single check. Keep the other safeguards in place: least privilege tools, spending limits, human approval for irreversible actions, and verifiable receipts so you can check what the agent actually did afterwards.