Designed, built, explored
Shadow
An open-source security framework for AI applications, combining prompt-injection checks, output scanning, canary tokens, and agent-trace auditing.
- AI Security
- Open-source
- PyPI
- MIT
Live interface
Try the scanner.
Try a sample input in the scanner. If the service is unavailable, explore the public source and documentation instead.
Pick a preset or paste your own injection, then Test it — the real shadowshield package scans it server-side.
Operating brief
The constraint.
Agentic applications encounter untrusted text in prompts, retrieved documents, and tool results. The design problem is to inspect those inputs and outputs without treating any one detector as a complete security boundary.
What the system does
Checks model inputs, including prompts, retrieved documents, and tool results, as well as outputs for potential secrets, personal information, and system-prompt leakage.
Layers detection: multilingual signatures, normalization-aware matching (zero-width/homoglyph/bidi), encoded-payload decoding, heuristic scoring, an optional DeBERTa classifier and LLM self-check — combined with a noisy-or aggregator.
Adds tool-call checks, canary tokens that can reveal an injection, and an agent-trace audit for possible goal hijacking.
Acts, not just alerts: sanitize, block, throttle, or isolate (spotlighting / datamarking), across strict / balanced / permissive modes.
Architecture
How it moves.
The same engine runs on input and output. Untrusted text is normalized, scored by a detector ladder, aggregated, then answered with an action.
- Untrusted text (input or output)
- Normalize & decode
- Detection ladder (signatures · vector · DeBERTa · LLM check)
- Noisy-or aggregator
- Response (sanitize · block · isolate)
Canary tokens can reveal an injection; an agent-trace audit helps surface possible goal hijacking.
Build ledger
What carries it.
- Language
- Python 3.10+ · strict typing · FastAPI service
- Detection
- Multilingual signatures (de/es/fr/it/pt) · optional DeBERTa · vector similarity
- Distribution
- PyPI (pip install shadowshield) · MIT license · OIDC release pipeline
- Testing
- Automated tests · benchmark harness
Current status
Delivered.
Published on PyPI under MIT, with automated tests and documentation.
Includes a benchmark harness for evaluating detection approaches and comparing results.
Integrations include LangChain middleware and an optional MCP guard server.