Find hidden prompt-injection text: ASCII smuggling, zero-width/emoji stego, bidi, homoglyphs.
Connect Remote server
claude mcp add --transport http smugglecheck https://smugglecheck.mike-tusa.workers.dev/mcp --header "Authorization: Bearer <YOUR_API_KEY>"
{
"mcpServers": {
"smugglecheck": {
"url": "https://smugglecheck.mike-tusa.workers.dev/mcp",
"headers": {
"Authorization": "Bearer <YOUR_API_KEY>"
}
}
}
}
{
"servers": {
"smugglecheck": {
"type": "http",
"url": "https://smugglecheck.mike-tusa.workers.dev/mcp",
"headers": {
"Authorization": "Bearer <YOUR_API_KEY>"
}
}
}
}
Settings > Connectors > Add custom connector
URL: https://smugglecheck.mike-tusa.workers.dev/mcp
Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.
Tools 2 found in our last check
scan_textScan untrusted text for prompt-injection smuggling and deceptive Unicode before it reaches a model or a reader. Detects Unicode tag characters ("ASCII smuggling", decodes the hidden text), zero-width characters (incl. binary stego decode), variation-selector stego ("emoji smuggl…
compare_stringsCompare two strings (usernames, domains, brand or command names) with Unicode UTS #39 skeletons and say whether they can look the same to a reader: identical, confusable, confusable_ignoring_case or distinct. Also returns each string's scripts, whether it mixes scripts, and its…
Headers
| Name | Description |
|---|---|
AuthorizationOptional, secret | Optional. 'Bearer sc_live_…' free key (POST /api/keys, no sign-up) for a monthly quota of your own. Works without a key. |
Details
| Endpoint | https://smugglecheck.mike-tusa.workers.dev/mcp (Streamable HTTP) |
| First published | 18 Oct 2026 |
| Last updated | 18 Oct 2026 |
| Registry name | dev.workers.mike-tusa.smugglecheck/smugglecheck |
More ai and media servers See all
Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.
