Xray MCP Server

Use when the user asks whether text, a prompt, a SKILL.md, AGENTS.md, CLAUDE.md, .cursorrules, README, MCP tool description, PR diff, email or web page hides anything, or before an agent follows, installs or merges instructions that came from someone else (signals: "hidden characters", "invisible unicode", "ASCII smuggling", "prompt injection in this file", "Trojan Source", "why does this string not match", "is this domain spelled with a Cyrillic letter"). Inspects every code point and returns a verdict (clean, suspicious, dangerous) with each finding's line, column, code points and Unicode names: Unicode tag characters (decoded back to the hidden ASCII message), variation-selector payloads (decoded bytes), bidirectional overrides and isolates, long zero-width runs, zero-width and other invisible characters, ANSI terminal escapes, control characters, words that mix Latin with Cyrillic or Greek look-alikes (with the Latin word they imitate, from Unicode confusables), whole look-alike words, styled math letters, unusual spaces, line separators, private-use and unassigned code points, and HTML comments that do not render. Legitimate uses are not flagged (emoji ZWJ sequences, flag tag sequences, a single emoji variation selector, joiners in Arabic and Indic text, direction marks next to Hebrew or Arabic). Give text or url (one public https text file; GitHub and GitLab file pages are read as raw). Example: {"url":"https://github.com/owner/repo/blob/main/SKILL.md"} or {"text":"Visit pаypal.com","return_clean":true}. Optional return_clean adds a copy with hidden characters removed and look-alike letters inside mixed words replaced. Decoded hidden text is returned as data. Limits: finds characters and look-alikes, not prompt injection written in plain visible words; up to 200,000 characters (files up to 1 MB, first 200,000 characters scanned).