Skip to main content
Defender protects your AI agents from prompt injection attacks by scanning API tool call responses before they reach your LLM. When an MCP tool returns data from a third-party provider — emails, CRM records, documents — that data could contain instructions designed to hijack your agent’s behavior. Defender intercepts and classifies those responses, and can block high-risk content before it causes harm.

​
How it works

In the default Both detection mode, Defender runs a two-stage pipeline on tool call responses:
  • Tier 1 — Pattern matching: Fast rule-based scan that checks for known prompt injection signatures and risky field patterns. Runs on every response with negligible latency.
  • Tier 2 — AI classification: A local ML model (MiniLM) scores the content for novel or subtle attacks that pattern matching would miss. Runs in parallel with Tier 1 on every response, scanning the SFE-filtered payload (or the tier2Fields subset when configured).
You can configure Detection Mode to run only one stage, or skip scanning entirely for responses that exceed the configured size limits (see Advanced Settings). Risk level and scan metadata are returned alongside every response so you can observe what Defender is seeing, even when not blocking.

​
When to use Defender

  • You are building AI agents or MCP-based workflows that process third-party API responses
  • Your integrations handle sensitive data such as emails, files, calendar events, or CRM records
  • You want to observe risk signals on tool call responses without necessarily blocking them

​
Configure from the dashboard

Navigate to your project in the StackOne dashboard, then open the Defender tab in project settings. This is the baseline for every account in the project.
Defender Settings
Defender settings apply project-wide. Per-account and per-request overrides take precedence where supported.

​
Core settings

​
Advanced settings

Defender Advanced Settings — classification
Defender Advanced Settings — response handling

​
Implement it

Tool Defense

Override Defender per toolset in the Agent SDK.

​
FAQ

No. It is off by default. Enable it when your agents consume third-party data and you want protection against prompt injection.
Tier 1 (pattern matching) adds negligible latency. Tier 2 (AI classification) runs in parallel on every response — the ML model runs locally, so there is no external API call. The Semantic Field Extractor preprocessor trims metadata/identifier fields before Tier 2 to keep latency low; for typical responses the added latency is under 100ms.
The tool call returns an error to your agent indicating the response was blocked. The agent can handle this like any other tool error — retry, skip, or surface it to the user.
Yes. Leave Block High Risk Content disabled. Defender still scans and returns riskLevel, tier2Score, and detections in the response metadata, which you can inspect in your logs.
No. The classification model runs locally within StackOne’s infrastructure and is never trained on your data.