Every feature you need to
secure AI at scale

Direct and indirect injection, jailbreaks, role manipulation, encoding and homoglyph bypass. Thirteen of the engine's threat types map here, more than any other row.

PII leakage, API key and secret exposure, training-data and knowledge-base extraction attempts. All four run on the model's response as well as the prompt.

Destructive payloads, plugin and tool hijacking, unsafe URLs, insecure code the model wrote.

Not covered: No provenance verification for models, adapters, datasets or packages. PromptGuard inspects the traffic to and from a model; it does not attest where that model or your dependencies came from. MCP manifest scanning is written (mcp_manifest_scanner.py) but is not yet reachable from a request path.

Adversarial documents planted in retrieved context or in agent memory, and GCG-style token soup appended to evade the injection classifiers.

Not covered: Retrieval-time poisoning only, and only for context you pass to the Guard API — a document we never see is a document we never scan. Training and fine-tuning pipelines sit upstream of a runtime gateway, so we make no claim about them.

PII and credentials in responses, toxic output, malicious URLs, insecure generated code. Every check here runs on the model's output before it reaches your application.

Unsafe tool calls, resource access outside the allowlist, shell injection via agents, the lethal trifecta, unauthorized sub-agent spawning.

Attempts to make the model reveal its system prompt, initial configuration or internal instructions.

Not covered: Inbound only. The attempt is caught in the prompt; the response is not scanned for system-prompt content that leaked anyway. The system_prompt_leak threat type is declared in engine.py but nothing emits it yet, and the canary-token detector that would close this has no caller.

Adversarial content in retrieved documents, and answers that the retrieved context does not support.

Not covered: We inspect the text you retrieve, not the store you retrieve it from: no vector-database access control, no per-tenant retrieval isolation, no embedding-inversion defence. The grounding check is lexical — key-term coverage and word overlap — not embedding similarity, which is why this row no longer claims semantic matching.

Unsupported claims, invented citations, fabricated statistics, self-contradiction, financial fraud. Runs on every proxied response, not behind a flag.

Automated abuse and model-extraction traffic, and single requests sized to burn a budget.

Not covered: No spend cap. Per-key rate limits are published as X-RateLimit-* headers but enforced at the load balancer, not by PromptGuard, and the engine holds no cost or denial-of-wallet budget. A sustained low-rate extraction campaign is not something this product stops today.