# Power Strip Security

> We've got your agent's back. Safe reading for AI agents: read a URL, or scan content you already have, for prompt injection. Strips hidden text, invisible characters and data-exfiltration links, flags instruction-override phrases in 13 languages, and returns the clean text wrapped as untrusted data. Deterministic, pay-per-call with x402 (USDC on Base). Your content is scanned in memory and never stored. Detection rates are published, measured on a held-out test set. Failed requests are never charged.

## Endpoints

Both are paid per call in USDC on Base (eip155:8453) with x402 v2 (scheme "exact"). No account, no API key.

### POST https://api.powerstripsecurity.workers.dev/v1/read — $0.005

- Body (JSON): {"url": "https://...", "format"?: "markdown"|"text"}.
- Fetches the page (public http/https only, robots.txt respected, up to 5 redirects, 5 MB, 10 s), cleans it and scans it.
- Response: {"final_url", "title", "language", "words", "risk", "level", "findings": [...], "content", "wrapped_text"}.
- Not charged when the page cannot be read: robots.txt disallows it, the site blocks it (login, CAPTCHA, 403, 429), it needs JavaScript, it is not HTML or text, or it is over 5 MB. Those return 422 with a reason.
- User-Agent "PowerStripSecurity/1.0 (+https://api.powerstripsecurity.workers.dev/)". Logins, CAPTCHAs and paywalls are never bypassed.

### POST https://api.powerstripsecurity.workers.dev/v1/scan — $0.002

- Body (JSON): {"content": string, "format"?: "html"|"text", "url"?: string, "return_text"?: boolean}. Max 256 KB.
- Response: {"risk": 0..1, "level": "low"|"medium"|"high", "findings": [...], "clean_text", "wrapped_text"}.

Put wrapped_text in your prompt instead of the raw page: hidden content removed and the rest marked as untrusted data.

## How to pay

Call without payment → 402 with a PAYMENT-REQUIRED header. Sign it with any x402 client (for example @x402/fetch) and retry with PAYMENT-SIGNATURE.
Invalid requests (4xx) and server errors are never settled.

## Signed receipts

Every paid response carries a "receipt" header: a JWS (EdDSA, Ed25519) with the resource, network, transaction, payer, amount and the sha256 of the exact response body (body_sha256, base64url).
Verify it with any JOSE library against https://api.powerstripsecurity.workers.dev/.well-known/jwks.json, then hash the body you got and compare. It proves what you paid for and what you received.

## What it catches (held-out test set, never used for tuning)

- Hidden injections (display:none, zero-size text, invisible Unicode, off-screen, comments, exfiltration links): 100% of 37.
- Visible plain-language injections: about 40% of 152 (strong on English and Spanish overrides, weak on paraphrased German chat prompts).
- False alarms on normal pages and texts: 1% of 295.

Use it as a cheap first filter for content from the open web, not as your only defense.

## MCP server

For Claude Desktop, Claude Code, Cursor and other MCP clients: "npx -y power-strip-security-mcp" (https://www.npmjs.com/package/power-strip-security-mcp) with PSS_PRIVATE_KEY (a dedicated wallet with a little USDC on Base) and PSS_MAX_SPEND_USD (spending cap, default 1). Tools: read_url, scan_content.

## Links

- OpenAPI: https://api.powerstripsecurity.workers.dev/openapi.json
- Status: https://api.powerstripsecurity.workers.dev/status
- Demo (a page with six hidden injections, before and after): https://api.powerstripsecurity.workers.dev/demo
- Contact: abdev.estudio@gmail.com

Built with Claude Code.