GlyphGuard MCP Server

by workers-mike-tusa-glyphguard Your server? Claim it

answering

GlyphGuard is answering right now. Last checked 11 min ago. It exposes 3 tools.

Find hidden Unicode (zero-width, bidi, tag payloads), homoglyphs and lookalike names in text.

Uptime history 17 days of history · worst day 99%

17 days agonow

100.0%

Uptime 24h

91 of 91 checks

Tools

read from the server

121 ms

Response time

average over 24h

open, no key

Access

streamable-http

Nothing serious here today

Today is the operative word: we check GlyphGuard every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 11 min ago.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add glyphguard --transport http https://glyphguard.mike-tusa.workers.dev/mcp

Settings → Connectors → Add custom connector, then paste this address

https://glyphguard.mike-tusa.workers.dev/mcp

~/.codex/config.toml

[mcp_servers.glyphguard]
url = "https://glyphguard.mike-tusa.workers.dev/mcp"

.cursor/mcp.json

{
  "mcpServers": {
    "glyphguard": {
      "url": "https://glyphguard.mike-tusa.workers.dev/mcp"
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "glyphguard": {
      "type": "http",
      "url": "https://glyphguard.mike-tusa.workers.dev/mcp"
    }
  }
}

Available tools 3

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

clean

clean_text

Return the text with invisible characters, bidi controls, tag characters and control characters removed and unusual spaces turned into normal spaces. By default ZWJ/ZWNJ/VS16 are kept inside emoji sequences, between letters of joining scripts (Arabic, Persian) and after an Indic virama (keep_joiners=true); strict=true removes them everywhere. Optional: map lookalike letters to Latin (lookalikes) and apply NFKC normalisation (nfkc). Read-only. Same engine as GET /api/clean.

compare

compare_names

Check whether a name, username, domain label or brand looks the same as any of up to 50 protected names (for example "pаypal" with a Cyrillic а vs "paypal"), using a UTS #39-style confusable skeleton (curated subset, case and accents ignored). Read-only. Same engine as GET /api/compare.

scan

scan_text

Find invisible characters, bidi controls (Trojan Source), hidden Unicode tag payloads (decoded), variation-selector runs, control characters, unusual spaces, mixed-script words and lookalike letters. ZWJ/ZWNJ/VS16 in legitimate context (emoji sequences, Persian/Arabic joining, Indic virama) are reported as info joiner_in_context and do not raise risk; elsewhere they stay medium. Lone surrogates are flagged. Returns a risk level (none/low/medium/high), counts, and findings with UTF-16 offsets and code points. Read-only. Same engine as GET /api/scan.

Endpoints

URL	Transport	State	Latency	Checked
https://glyphguard.mike-tusa.workers.dev/mcp	streamable-http	answering	96 ms	11 min ago

Alternatives to GlyphGuard

same job, measured the same way

Ghostchars

by ghostchars

Find and remove invisible Unicode: zero-width, tag smuggling, bidi, homoglyphs. Offline.

53 installs/wk local only

SmuggleCheck

by workers-mike-tusa-smugglecheck

Find hidden prompt-injection text: ASCII smuggling, zero-width/emoji stego, bidi, homoglyphs.

2 tools answering

Unicode-LE

by nolindnaidoo

Find the Unicode that hides meaning: bidi controls, invisibles, homoglyphs and mixed scripts.

65 installs/wk local only

Vinv

by vinvai

Vinv runs, tests, and finds issues in your services — with zero code changes.

69 installs/wk local only

Archive Zip Unzip Bomb Guard

by bestremotetools

Pack a folder with a glob, look inside an archive, unpack it with bomb, traversal and symlink guards

local only

Punycode MCP

by mrfentmen

Convert internationalised domain names between Unicode and punycode (IDNA), label by label.

156 installs/wk local only

GLØDI

by glodi

Find clinics, treatments, prices and free times on GLØDI in Norway, with booking links.

26 tools answering

Hivex: .si names, DNS and WHOIS

by hivex

Find and check free .si names (600,000+ indexed), and look up DNS and WHOIS for any domain.

4 tools answering

GlyphGuard — questions

Answers built from our own checks of this server.

What can GlyphGuard do?

It exposes 3 tools, read directly from the server on our last check. Among them: clean_text, compare_names, scan_text. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →

Is GlyphGuard working right now?

We send a real MCP handshake every 15 minutes. Over the last 24 hours 91 of 91 checks got a reply (100.0%), average response time 121 ms. The bar chart above shows every period we have measured.

How do I connect GlyphGuard?

Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.

Does GlyphGuard need an API key?

No. GlyphGuard completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 3 of them are readable on this page. This is what we observed, not what the docs claim.

How fast is GlyphGuard?

It answers our handshake in 121 ms on average, which is faster than 91% of all working MCP servers we measure. That puts it in the quick quarter of the ecosystem. The comparison comes from our own checks across the whole registry, every 15 minutes.