AGENT FIREWALL
Prompt injection is OWASP LLM01. Agent Firewall is the deterministic gate an agent calls on everything it ingests or emits: known-pattern injection matching, URL/IP vetting, pwned-password checks, and secret/PII redaction. No LLM.
FreeDeterministic — no LLMHIBP · RDAP · Tor · Team CymruHTTP + MCP
verdict appears here…
| Endpoint | What it does |
|---|---|
/api/scan-content | Match against 11 known injection/jailbreak patterns + 5 obfuscation signals (zero-width, bidi, tag block, hidden HTML, comment instructions) → allow/review/block + the rule IDs that fired |
/api/scan-secrets | 22 secret patterns — AWS access key ids, GitHub tokens, OpenAI, Anthropic, Google, Slack, Stripe live secret keys, Twilio, npm tokens, JWTs, PEM private-key blocks, Azure storage keys, SAS tokens and AD client secrets, GCP service-account key ids and OAuth refresh tokens, database and ODBC connection-string passwords, SendGrid, GitLab, Hugging Face, and a generic key = "value" assignment — plus 3 PII patterns: email, US SSN, Luhn-checked card numbers. A credential from a vendor not on that list will not be found unless it happens to look like an assignment, and that rule is narrow: api-key = "abc12345" matches, but {"api_key": "abc12345"} does not, because the quoted key name defeats the pattern. The redacted copy removes the value and leaves the label: api_key = "[REDACTED:Generic Secret Assignment]". A PEM block goes in full. |
/api/check-url | URL/domain safety: punycode hosts, 14 known shorteners, 23 abuse-prone TLDs, raw-IP hosts, credentials in the URL, brand lookalikes, domain age from RDAP, and the final URL after redirects (I re-run the checks on it, and count them if it is a different host; the intermediate hops are not reported). Domain age is looked up for the host you passed in, not the one you land on. "Brand lookalike" means one of 14 brand names appears in the host but is not the registrable domain — paypal.com.secure-login.tk. It is a substring test, not edit distance and not homoglyphs. |
/api/check-ip | IP reputation: Tor exit (Tor Project bulk exit list), ASN/org (Team Cymru), reverse DNS, a datacenter guess from the org name, and one DNSBL lookup — Spamhaus ZEN, IPv4 only. If that lookup is refused or errors I return listed: null with a note. Only listed: true moves the score, so an inconclusive lookup ends up with the same verdict as a clean one. Read blocklist.listed, not just the verdict. |
/api/check-password | Is a password breached? HIBP k-anonymity (plaintext never leaves the server) |
{ "mcpServers": { "agent-firewall": { "command": "npx", "args": ["-y", "agent-firewall-mcp"] } } }
It is a pattern matcher, not a classifier. 11 regex rules for known injection and jailbreak phrasings, plus 5 obfuscation checks: zero-width characters, bidi overrides (Trojan Source), the Unicode tag block, CSS-hidden text, and instructions buried in HTML comments. Every rule has an ID and a weight, and the response tells you which ones fired.
It will not catch an attack phrased in a way I did not anticipate. Rewording beats a regex. There is no understanding of meaning here, so a novel paraphrase, a non-English payload, or an instruction split across sentences can walk straight through.
Use it as one layer. Do not use it as the reason it is safe to feed untrusted text to a model. The obfuscation checks are the part I would actually rely on: hidden characters are hard to introduce by accident, so a hit there is a strong signal.