mcpbeat Sign in

Injectshield MCP Server

local only

Injectshield runs on your own machine — the client starts it, so there is no endpoint to ping. 24 installs a week from npm. Last commit 6 Jun 2026.

Prompt-injection firewall for AI agents — scan untrusted text before LLM calls.

Installs per day peak 11 · avg 4 · +189% w/w
a month agotoday
24
Installs / week
npm · @injectshield/mcp
0
Stars
0 open issues
6 Jun 2026
Last commit
0 releases in 90 days
MIT
License
TypeScript

Nothing serious here today

Today is the operative word: we check Injectshield every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.

Three servers free · no card

Connect this server

This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.

run in your terminal
claude mcp add injectshield -- npx -y @injectshield/mcp
~/Library/Application Support/Claude/claude_desktop_config.json
{
  "mcpServers": {
    "injectshield": {
      "args": [
        "-y",
        "@injectshield/mcp"
      ],
      "command": "npx"
    }
  }
}
~/.codex/config.toml
[mcp_servers.injectshield]
command = "npx"
args = ["-y", "@injectshield/mcp"]
.cursor/mcp.json
{
  "mcpServers": {
    "injectshield": {
      "args": [
        "-y",
        "@injectshield/mcp"
      ],
      "command": "npx"
    }
  }
}
.vscode/mcp.json
{
  "mcpServers": {
    "injectshield": {
      "args": [
        "-y",
        "@injectshield/mcp"
      ],
      "command": "npx"
    }
  }
}

This one needs environment variables set before it will start: INJECTSHIELD_API_KEY (API key from https://injectshield.dev (free tier: 10K req/mo).), INJECTSHIELD_API_BASE (Override the API base URL for self-hosted deployments.). The author declared them in the registry entry; get the values from the project itself.

Alternatives to Injectshield

same job, measured the same way
Lovec
by lovec-tech

Prompt-injection detector for untrusted text before it reaches an LLM (RU/EN). BYO lovec.tech key.

local only
Safeprompt
by safeprompt

Detect prompt injection, jailbreaks, and code injection in untrusted text before it reaches an LLM.

37 installs/wk local only
Shadowgate MCP
by josephibra

Security firewall for AI agents — scans MCP calls for injection, secrets, and risks.

answering
Mails.ai — Agent Email
by rolloutsai

A real inbox for AI agents: send, receive and thread email, behind a prompt-injection firewall.

76 installs/wk local only
Cloakcheck
by vercel-cloakcheck-wheat

Scan a page for hidden prompt-injection payloads targeting AI agents.

1 tools answering
sqz
by ojuschugh1

Pre-injection context compression for coding agents. Zero LLM calls, zero telemetry, offline-safe.

local only
Tripwire
by bonesdefi

Security gateway for MCP agents: blocks prompt-injection-driven tool calls before they execute.

35 installs/wk local only
prompt-protection
by mughalhere

Scan prompts, tool definitions and model output for injection, and guard agent tool calls.

575 installs/wk local only

Injectshield — questions

Answers built from our own checks of this server.

Why is there no uptime for Injectshield?
Injectshield runs on your own machine over stdio — there is no network address to reach, so uptime cannot be measured for it by anyone. What can be measured is adoption: the npm package @injectshield/mcp was installed 24 times last week.
How do I connect Injectshield?
Copy the ready config from this page — we generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each with the file path that client actually reads. It runs locally, so the command pulls @injectshield/mcp straight from npm; nothing to host, nothing to sign up for.
How many people use Injectshield?
The npm package @injectshield/mcp was installed 24 times in the last week. Week over week that is +189%. We show installs rather than GitHub stars on purpose: a star is a bookmark, an install is someone actually running it.
Is Injectshield open source?
Yes — it is published under the MIT licence, written in TypeScript and 0 stars on GitHub. The source link is on this page, so you can read exactly what it does with your data before you connect it.