isinjected

Is this prompt malicious?

A trust gate for AI agents. Scan any fetched page, email, ticket, or tool result for prompt injection — and check every link it contains against 30M threat indicators — before your agent acts on it.

Start free Read the API docs

1,000 scans/month free, no credit card. Scans are metered separately from your API request quota.

Try it — paste content to scan

Instruction override & jailbreaks

"Ignore all previous instructions", fake system prompts, role hijacks, and DAN-style jailbreaks — caught before they reach your model.

Invisible & encoded payloads

Unicode tag-smuggling, zero-width characters, bidi overrides, and base64/percent-encoded instructions are decoded and flagged.

Data exfiltration & malicious links

Markdown-image beacons, data: URIs, and any URL/domain/IP checked against known-malicious infrastructure.

Tool-call forgery

Forged tool calls, function-call structures, and shell exhortations that try to drive your agent's tools.

One call before your agent acts

Send the untrusted content; get back block, warn, or allow, with the flagged spans and a sanitized copy.

curl -X POST "https://ismalicious.com/api/gate/scan" \
  -H "X-API-KEY: $ISMALICIOUS_KEY" \
  -H "Content-Type: application/json" \
  -d '{"content": "…fetched page text…", "source_url": "https://example.com"}'

Prefer MCP? Add the @ismalicious/mcp-server and your agent gets a scan_before_use tool automatically.