Bouclier.aiBouclier.aiBeta
Live demoHow it worksBenchmarksFor agentsPrivacyTermsDownload
Betav0.9.10 — runs entirely on your Mac

Web pages should not
give your agents instructions.

Bouclier.ai is a prompt-injection firewall that runs on your Mac, between your coding agent and the model provider. It reads the content your agent pulls in from the outside — a fetched web page, a search result, an MCP response — and flags anything trying to reprogram it. It monitors by default; flip on blocking and it refuses those requests outright. Your own prompts, and the files you read from your own project, are never touched. No certificate to install.

Beta — research prototype. Not meant to be used live.

Bouclier is published for evaluation, security research, and personal experimentation. It is not a commercial product, is not supported, and is not meant for production, regulated workloads, or any environment where a failure could cause harm. Detection is best-effort and evadable by a determined attacker — it raises cost, it is not a guarantee. See the Terms before installing.

Download for macOSTry to sneak one past it

Local-only. 186 detection patterns and an on-device ML classifier run on your Mac. No cloud scanning, no telemetry, no accounts.

Live demo

Same words. Different verdict.

Paste anything, then flip where it came from. Instructions inside tool output get the request refused — nobody in your session typed them, so they have no business giving orders. The identical sentence typed by you is logged and forwarded, because you are the one the agent works for. The regex tier that ships in the Mac app runs right here in your browser; nothing leaves your machine. The app also fuses in an on-device ML classifier and false-positive dampeners the browser can't run, so it catches more than this demo.

Tool output166 chars
Gateway decisionREFUSED
Fused score
0.500
Categories
6
Severity
critical

Matched patterns

8
  • Tool result manipulationIndirect Injection
  • System prompt overrideRole Hijack
  • Word splitting obfuscationObfuscation
  • Ignore then revealPrompt Leaking
  • System prompt extractionData Exfiltration
  • Reveal your system promptPrompt Leaking
  • Homoglyph / Cyrillic lookalike injectionEncoding Bypass
  • Verbatim instructions requestPrompt Leaking

What happens to the request

Refused. The agent receives a 422 with the matched pattern and the JSON path it came from. The model never sees the content, and nothing is silently altered.

Bouclier never edits your prompt. A request is either forwarded byte-for-byte or refused outright with a 422 naming what matched and where — earlier versions rewrote flagged text in place, which broke prompt caching and tripped provider abuse detection, and that behaviour is gone for good.

How it works

It knows which bytes you wrote.

Every guardrail that scans "the prompt" eventually blocks its own user — the security engineer pasting an advisory, the developer testing a jailbreak. Bouclier splits the request by origin before it scores anything, so the action it takes depends on who said it, not just what was said.

Untrusted — flagged, or refused

tool_result blocks, role: "tool" messages, function_call_output items, and retrieved content — document / search_result blocks and anything wrapped in the <document> RAG convention, even inside a user turn. Content your agent pulled from outside your workspace — the web, a search, an external tool. Nobody in the session wrote it, so an instruction in there is an attack by definition. By default it's logged and forwarded (monitor mode); turn on blocking and the request is refused with a 422 naming the pattern and the JSON path.

Yours — never blocked

Your prompt and system prompt — you are the principal, allowed to discuss attacks with your own model — and the files your agent reads from your own project: your docs, your CLAUDE.md, your research notes. A file read from a path you control is trusted like your own words: scanned so the activity log stays useful, never blocked. Only content from outside your workspace can be refused — and the fetch-then-read dodge is still caught, because the fetch itself is inspected. Teams that want to police everything can turn on the stricter posture by MDM policy.

What it does not claim

Prompt injection is not solved, and a pattern engine is not a solution to it. The defences that actually hold are structural — constraining what a hijacked agent can reach, keeping untrusted input away from privileged actions. Bouclier is defence in depth on the untrusted leg: it raises the cost of the easy attacks and shows you when one arrives. Treat it the way you treat a WAF, not the way you treat a proof.

What it does not stop

  • An adaptive attacker. The detector matches known patterns; someone deliberately shaping a payload to slip past it will succeed. Public red-team results bypass every pattern-layer defence eventually.
  • A process that doesn't route through the gateway. Protection is opt-in per process via ANTHROPIC_BASE_URL / OPENAI_BASE_URL. Anything that ignores those env vars (a tool with a hard-coded base URL, an already-running shell, an app with its own backend) talks to the provider directly.
  • Injection the model reads by another path. Content in your own prompt, system prompt, or a file you read from your own project is treated as yours and forwarded unchanged; very large tool results are size-capped; today only Anthropic and OpenAI traffic is routed.
  • Damage from an action that already ran. Bouclier inspects the request going out, not the model's tool calls coming back. Response-side action gating is on the roadmap, not shipped.
How we measure

Real numbers, on data we didn't write.

We run the shipped pipeline — the 186 patterns, the false-positive dampeners, and the on-device Prompt Guard 2 classifier — against third-party corpora, and publish the harness so you can reproduce it. Each test string is scored as untrusted tool output, exactly as the gateway would.

~1%

False positives on benign content

Across 512 external benign prompts — including NotInject, a set built to trip guardrails with security vocabulary — the shipped build blocked 0.6% (1.8% on NotInject alone). This is the number that matters for staying out of your way, and it's the hard one to game.

~99%

Instruction-override injections caught

On 777 payloads from a public instruction-override corpus (Lakera's gandalf set). This is detection on a static corpus of one attack class — read it as coverage of known families, not a guarantee.

What these numbers are not

These are static-corpus results. They say nothing about an attacker optimizing against the detector — every detector of this kind, ours included, is bypassed at high rates under adaptive attack. A clean pass is not evidence of safety. The default install runs in monitor mode and blocks nothing until you turn enforcement on. Measured on v0.9.10 (10 Aug 2026); numbers move with each release.

Reproduce it — the harness + corpora→
Built for agents

Drive it from Claude Code — or any agent.

Bouclier ships an MCP server and a bouclier CLI that share one core. An agent can orient itself — is protection on, how much has it inspected — before it acts. What it can't do is the point: the CLI is read-only. There is no agent path to disable protection. The tool can't switch off the thing guarding it.

the agent's view
# orient before acting
bouclier status
→ protection ON (standard mode) · 128 inspected, 0 blocked

# there is no disable command
bouclier --help
→ status · install · --version  (read-only, by design)
🟢

Read, freely

bouclier status returns protection state, mode, and activity counts as JSON. An agent can check it's protected before it runs — no approval needed to read.

🔌

One MCP server

Register the injection MCP with Claude Code once (bouclier install prints the command). Same read-only core as the CLI.

🔴

Never the agent

Disable protection or uninstall — neither has an agent path, only a human one in the app. The tool can't weaken its own guard.

No certificate

What reaches the model — and what doesn't.

Bouclier points your AI tools at a local gateway by setting a base URL — no root certificate, nothing installed in your trust store, no system-wide interception. The gateway never rewrites a request: it forwards it byte-for-byte, or refuses it outright. There is no in-between.

01

Prompts

Forwarded byte-for-byte. Bouclier has no rewrite path at all — a request is delivered unmodified or refused. No blind redactor touching your fields, nothing spliced into your prompt.

02

Headers

Authorization, x-api-key, trace IDs, analytics — every header reaches the upstream unmodified, so your tools keep working. Pinned by an end-to-end test so a future change can't drift.

03

Loopback only

The gateway binds 127.0.0.1 and nothing else — there's no system-wide traffic redirection. Only processes that explicitly point at it (ANTHROPIC_BASE_URL / OPENAI_BASE_URL) are ever in scope.

Bouclier installs nothing in your trust store. The byte-identical guarantee — a request is forwarded unchanged or refused, never rewritten — is pinned by an end-to-end test in CI on every release.

Enterprise

Ready for your security team.

MDM managed

Deploy and configure via Jamf, Kandji, or Mosyle. Control the gateway port, additional AI domains, and feature flags — including enforcement mode — across your fleet.

Fleet-wide enforcement

Ship monitor mode to learn your baseline, then flip blocking on by policy when you're ready. A single MDM flag turns the whole fleet from detect-and-log to refuse.

Audit trail

Every inspected request and every refusal is logged locally and can be forwarded to your SIEM. Export a privacy-scrubbed diagnostics bundle for incident response.

Tamper-resistant

An agent can use Bouclier but never weaken it — disabling protection has no agent path, only a human one in the app. The tool can't switch off its own guard.

Privacy

Nothing leaves your Mac.

Detection runs entirely on your Mac — 186 patterns and the on-device ML classifier. Your traffic never leaves the machine to be inspected.

No cloud LLM, no analytics, no telemetry in the app.

Scan logs never contain your prompts, responses, or API keys — only metadata.

Bouclier installs no certificate — the gateway is a plaintext-loopback relay, not a TLS-terminating proxy.

Published threat model and privacy policy covering every trust boundary.

Put a firewall between your agent and the web.

Download the DMG, drag to Applications, click Enable. Every tool result your agent reads is inspected for injection from that moment — on your Mac, nothing installed.

Download for macOS

macOS 15+ · Apple Silicon & Intel · v0.9.10

Bouclier.aiBouclier.aiBeta
PrivacyTerms

Experimental, pre-1.0 software. Detection is best-effort; false positives and false negatives will occur. Not intended for production or regulated workloads — see Terms.