Skip to main content
The MeshAI proxy scans every outbound LLM request for prompt injection patterns. This scanning is always on - it runs on every request the proxy forwards, independent of any governance policy. There is nothing to configure or enable; you cannot turn it off via a policy, and there is no prompt_injection policy to create for this purpose.
The prompt_injection policy type exists in the policy type enum for API completeness, but scanning itself does not read policy configuration - it is hardcoded proxy behavior applied uniformly to every request.

​
How It Works

  1. Every request flowing through the proxy has its message content (and top-level prompt/content/input fields) scanned against a fixed set of prompt injection patterns.
  2. If a pattern matches, the proxy blocks the request with 403 Forbidden before it reaches the LLM provider.
  3. No audit event is emitted for a detected injection, and the original prompt is not stored by this check. Only a warning-level application log line records the matched pattern, truncated for the operator. Because blocked requests are not forwarded, the optional payload-capture path does not capture them.

​
Patterns Detected

The scanner checks the request text (after Unicode NFKC normalization and zero-width-character stripping) against 15 fixed regular expressions across six categories: Detection is a fixed-confidence match: any pattern hit is reported at confidence 0.85. There are no configurable sensitivity levels.

​
What the Agent Sees

When a prompt injection is detected, the agent receives:
There is no policy_id in the response - this check is not tied to a specific policy.

​
Enforcement Architecture

  • Scan path: The proxy scans messages content (string or structured text parts) plus top-level prompt/content/input fields before forwarding to the LLM provider.
  • Fail-open on parse failure: If the request body isn’t valid JSON, the scan is skipped and the request proceeds - this check only inspects bodies it can parse.
  • No audit trail entry: Detections are logged to the application logger only and do not appear in GET /audit-trail. The blocked prompt is not persisted by the prompt-injection check or optional payload capture.