Prompt Injection Surface

Scans AI app source code for prompt injection risk at LLM call sites.

Overview

Scans AI app source code for prompt injection risk at LLM call sites. Walks .ts/.tsx/.js/.jsx/.py/.mjs/.cjs source files, locates LLM SDK call sites (anthropic, openai, @ai-sdk/*, google generative), and flags user input flowing into prompts without sanitization, calls without max_tokens caps, system/user prompt mixing, and LLM output used unvalidated in fetch/exec/eval. Returns 0-100 score, per-finding kind/severity/path/line/evidence/recommendation, and a Venice plain-English verdict. Dual input: {repo: 'owner/name'} (tree-walk, capped 500 files) or {files: [{path, content}, ...]}. Use it as an LLM call-site audit, unsanitized-user-input-in-prompts detector, system-message mixing flag, unbounded completion detector, AI app safety scan, or pre-deploy AI risk gate.

Endpoint

Method	Endpoint	Price	Description
POST	/v1/marketplace/api/prompt-injection-surface	$0.0345	Invoke Prompt Injection Surface (Search) and return the upstream response.

How to call it

Requests are paid per call over the x402 protocol. Call the endpoint, receive a 402 Payment Required quote, then repeat the request with the signed payment header. The SDKs do both steps for you.

# 1. Ask for a quote
curl -i -X POST https://api.jarvisclaw.ai/v1/marketplace/api/prompt-injection-surface \
  -H 'Content-Type: application/json' \
  -d '{}'

# 2. Pay it (the SDK signs and retries for you)
curl -X POST https://api.jarvisclaw.ai/v1/marketplace/api/prompt-injection-surface \
  -H 'Content-Type: application/json' \
  -H 'X-PAYMENT: <signed-payload>' \
  -d '{}'

Open in the marketplace