ProbeGate runs a library of known prompt-injection and jailbreak probes against your own tool-call endpoint and tells you, mechanically, which ones got through. Part of the Trust & Ops Suite — this one ships free.
Instruction override, persona hijack, system-prompt exfiltration, filter evasion (zero-width, homoglyph, base64), indirect injection — listed in the open at /v1/probes, never a black box.
Each probe carries a unique marker. "Vulnerable" means the marker came back verbatim — never a subjective call about whether output "looks like" a jailbreak.
Every probe is a real POST to your own target_url. An unreachable target is reported as an error, never faked as "blocked."
Every run requires confirm_authorized: true — a lightweight guard against pointing this at infrastructure that isn't yours.
curl -X POST http://localhost:8417/v1/runs \
-d '{
"target_url": "http://localhost:8404/v1/tool_call",
"tool_name": "fs_write",
"inject_field": "content",
"base_arguments": {"path": "probe.txt", "content": "placeholder"},
"confirm_authorized": true
}'
Honest scope note: a clean run against a purely deterministic tool (like the example above) mostly confirms a keyword pre-filter exists — it isn't evidence an LLM sitting behind that same tool call would resist the same payload. ProbeGate's real target is the LLM-facing surface: an agent's own prompt handling, or any tool that feeds retrieved or user-controlled text back into a model. See the README for a full run against ToolWarden's real screen.
docker build -t probegate -f Dockerfile . docker run -p 8417:8417 probegateView API docs