Open source
Light
Pattern matching and a local classifier: known injection shapes, and the phrasings no rule anticipates. 22 MB, about 2.5 ms, on CPU, no external call.
DefenderPrompt injection defense for AI tool calling
Agents read untrusted text. Then they act on it.
incoming tool result
Every frontier model we tested acts on it
Full panel, attack library and method on the Attack Benchmark.
Light, Hybrid or Deep
One detection stack, three ways to run it on every tool result. Light Scan is open source and runs in your process. Deep Scan is a larger model from StackOne: Deep runs it on everything, Hybrid only where Light Scan is unsure.
StackOne
Hybrid
Light Scan on everything, and Deep Scan on the results it is unsure about. You get Deep Scan's judgement where it changes the answer, at a fraction of the calls.
StackOne
Deep
Deep Scan reads every tool result for intent rather than phrasing, which catches attacks written to look like ordinary data. Run it in our infrastructure or yours.
Defender reports a risk level and returns the scanned content. Whether to block is your decision, not ours.
Three ways to run it
Defender is one detection stack reached three ways. Most StackOne customers never install anything. The library is available for TypeScript and Python; the two paths above it are configured rather than installed.
If you call tools through StackOne
Platform
Defender runs server-side on every RPC call, so it covers any agent in any language, including MCP. Configure it per project from the dashboard. No code.
Choose how much runs per project: Light, Hybrid or Deep.
If you build agents on the TypeScript SDK
Agent SDK
Override the project setting for one toolset with the defender option on StackOneToolSet. Scanning still happens server-side; the SDK decides the policy.
If you want it in your own stack
Library
Install @stackone/defender for TypeScript or stackone-defender for Python, and call it wherever you handle tool results. Both track the same version and run entirely in your process, on any tool output rather than only StackOne's.
Where a per-result classifier reaches its limit
Some attacks are built so that no single tool result contains a complete injection. One read carries a plausible instruction, another carries only a value, an address or an id. A classifier looking for injection-shaped text has little to fire on in either. Deep Scan reads each result for what it is trying to get done, which is what catches them.
Request Deep Scan access
Deep Scan is a model that reads the results the local scan cannot resolve by itself. It runs on a subscription, in our infrastructure or yours. Tell us what you are protecting and we will get back to you.
Thanks, that reached us. We will reply to the address you gave.
That did not go through. Check the name, email and company fields, then try again.
We need a work address. Personal email providers are not accepted. Use the address you have at your company.
Something broke on our side. Nothing was sent. Please try again shortly.