MCP guard behavior and limits
MCP guard behavior and limits
LyraShield AI includes a deterministic guard that filters MCP tool-call inputs before they reach the scan engine. This page documents what the guard matches, how it normalizes input and where it stops. It states no results and no figures, because the evaluation harness that produced earlier numbers is not part of this repository.
Last reviewed:
What the guard does
The guard is a deterministic filter that runs on MCP tool-call arguments. Each call is classified as blocked, sanitized or allowed. A blocked call never reaches the model. An allowed call passes through, and the underlying model's own safety training becomes the last line of defense.
This is not a model safety test. The guard is a rule-based filter, not a classifier. It tests whether a tool-call argument carries injection language, and it makes no claim about what the model would do with that argument if it arrived.
Pattern categories
The guard matches a fixed set of prompt-injection categories, drawn from published guidance including the OWASP Gen AI Red Teaming Initiative. Each category maps to a named rule so a block can be explained.
| Category | What it catches |
|---|---|
| Instruction override | Attempts to replace or ignore the agent's instructions. |
| Role hijack | Attempts to reassign the agent's role or persona. |
| Memory wipe | Attempts to clear or discard prior context. |
| Prompt extraction | Attempts to reveal system instructions. |
| Secret extraction | Attempts to read environment variables or credentials. |
| Code execution | Attempts to run shell commands or eval-shaped payloads. |
| File access | Attempts to read or write paths outside the tool's scope. |
| Destructive commands | Attempts to delete or overwrite data. |
| SQL injection | SQL-shaped payloads inside a tool argument. |
| Encoding and obfuscation | Base64, leetspeak, homoglyph, zero-width and percent-encoded attempts to evade matching. |
| Framework tags | System and ChatML tag injection. |
How it handles input
Trivial obfuscation is normalized before matching so a payload cannot slip past on spelling alone. The guard maps cross-script Unicode homoglyphs to their Latin equivalents, applies NFKC normalization, replaces zero-width and invisible control characters with spaces, decodes percent-encoded input and maps leetspeak digits to letters. Standalone base64-shaped tokens are decoded and appended for matching.
The guard runs with a bounded input length, a strict mode and a match timeout. An input that exceeds the length bound or the timeout is not silently allowed through.
Known limitations
- →Dot-separated tokens. "ig.nore" does not match "ignore". Stripping intra-word dots would break legitimate paths such as "config.js", so the guard leaves them alone.
- →Non-English instructions. The pattern set is English-only. An instruction written in another language is not matched.
- →No completeness proof. A finite rule set cannot show that every injection attempt is caught. A clean result means no known pattern matched.
What this is not
- • Not "AI safety tested" in the sense of a formal evaluation by NIST, MLCommons or a third-party lab.
- • Not "adversarial robustness proven" — no finite rule set proves universal robustness.
- • Not certified by OWASP or any standards body.
- • Not a guarantee that the guard blocks every prompt injection attempt.
- • Not a substitute for model-level safety training, output filtering or human review.
See methodology for the full scan and evidence methodology.
MCP guard questions
Is LyraShield's MCP guard certified by OWASP or another standards body?
No. The guard's pattern categories are drawn from published prompt-injection guidance including the OWASP Gen AI Red Teaming Guide, but no standards body has certified the guard or this page.
Does the guard block every prompt injection attempt?
No. No finite rule set can prove that, so LyraShield does not claim it. The guard names the patterns it matches and the patterns it does not.
Does the guard also filter harmful content?
No. It blocks attempts to override, hijack or extract instructions from the agent. Filtering harmful but non-injection content is the responsibility of the underlying model's own safety training, not this guard.
Can this replace human security review or model-level safety training?
No. It is a bounded, scoped filter. It is not a substitute for model-level safety training, output filtering or human review.
Start with a check you can inspect.
The free tools run locally in your browser and state their limits.