● free & open-source — no license key

Test your MCP tool calls like an attacker would.

ProbeGate runs a library of known prompt-injection and jailbreak probes against your own tool-call endpoint and tells you, mechanically, which ones got through. Part of the Trust & Ops Suite — this one ships free.

How it works

10 named probes

Instruction override, persona hijack, system-prompt exfiltration, filter evasion (zero-width, homoglyph, base64), indirect injection — listed in the open at /v1/probes, never a black box.

Mechanical grading

Each probe carries a unique marker. "Vulnerable" means the marker came back verbatim — never a subjective call about whether output "looks like" a jailbreak.

Real HTTP, real target

Every probe is a real POST to your own target_url. An unreachable target is reported as an error, never faked as "blocked."

You confirm authorization

Every run requires confirm_authorized: true — a lightweight guard against pointing this at infrastructure that isn't yours.

Try it

curl -X POST http://localhost:8417/v1/runs \
  -d '{
    "target_url": "http://localhost:8404/v1/tool_call",
    "tool_name": "fs_write",
    "inject_field": "content",
    "base_arguments": {"path": "probe.txt", "content": "placeholder"},
    "confirm_authorized": true
  }'

Honest scope note: a clean run against a purely deterministic tool (like the example above) mostly confirms a keyword pre-filter exists — it isn't evidence an LLM sitting behind that same tool call would resist the same payload. ProbeGate's real target is the LLM-facing surface: an agent's own prompt handling, or any tool that feeds retrieved or user-controlled text back into a model. See the README for a full run against ToolWarden's real screen.

Get it

docker build -t probegate -f Dockerfile .
docker run -p 8417:8417 probegate
View API docs