Injectshield runs on your own machine — the client starts it, so there is no endpoint to ping. 41 installs a week from npm. Last commit 6 Jun 2026.
Prompt-injection firewall for AI agents — scan untrusted text before LLM calls.
Nothing serious here today
Today is the operative word: we check Injectshield every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.
Connect this server
This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.
claude mcp add injectshield -e 'INJECTSHIELD_API_KEY=<INJECTSHIELD_API_KEY>' -- npx -y @injectshield/mcp{
"mcpServers": {
"injectshield": {
"command": "npx",
"args": [
"-y",
"@injectshield/mcp"
],
"env": {
"INJECTSHIELD_API_KEY": "<INJECTSHIELD_API_KEY>"
}
}
}
}[mcp_servers.injectshield]
command = "npx"
args = ["-y", "@injectshield/mcp"]
env = { INJECTSHIELD_API_KEY = "<INJECTSHIELD_API_KEY>" }{
"mcpServers": {
"injectshield": {
"command": "npx",
"args": [
"-y",
"@injectshield/mcp"
],
"env": {
"INJECTSHIELD_API_KEY": "<INJECTSHIELD_API_KEY>"
}
}
}
}{
"servers": {
"injectshield": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@injectshield/mcp"
],
"env": {
"INJECTSHIELD_API_KEY": "<INJECTSHIELD_API_KEY>"
}
}
}
}Put your own value in place of
<INJECTSHIELD_API_KEY> (API key from https://injectshield.dev (free tier: 10K req/mo)).
The author’s registry entry marks it as required.
Optional settings from the registry entry, left out of the block above:
INJECTSHIELD_API_BASE (Override the API base URL for self-hosted deployments).
Alternatives to Injectshield
same job, measured the same wayPrompt-injection detector for untrusted text before it reaches an LLM (RU/EN). BYO lovec.tech key.
Detect prompt injection, jailbreaks, and code injection in untrusted text before it reaches an LLM.
Security firewall for AI agents — scans MCP calls for injection, secrets, and risks.
A real inbox for AI agents: send, receive and thread email, behind a prompt-injection firewall.
A real inbox for AI agents: send, receive and thread email, behind a prompt-injection firewall.
Prompt-injection scanner for agents: risk score, categories and spans for text, pages, MCP tools
Scan a page for hidden prompt-injection payloads targeting AI agents.
Scans untrusted web pages, emails, MCP responses, or A2A payloads for hidden prompt injections an.
Injectshield — questions
Answers built from our own checks of this server.