HOW IT WORKS

Five checkpoints

before your agent reads.

Every file in an untrusted repo passes through a gate before any AI agent is allowed to read it. Nothing from the repo is executed along the way.

01
Repo opened
Read-only, never run
Bob gates it
02
Bob gates it
Security Gate mode
03
Rules scan
11 rules, under 1 ms a file
Granite judges
04
Granite judges
Live on IBM watsonx
05
Verdict
SAFE · REVIEW · BLOCK
AFTER THE SCAN

BLOCK is not the end.

Get a clean copy.
Hidden text removed

Invisible characters are stripped. Comments addressed to an AI and lines that give the agent orders are replaced by a [Subtext] marker.

Rescanned and listed

The copy is scanned again to confirm it is clean, and every change is listed by line. The original repo is never modified.

One button or one flag

On the demo, press Get clean copy on any flagged file. In the CLI, add --sanitize ./clean.

What you see

is not what the agent reads.
node-api-starter · README.mdrendered
node-api-starter
A minimal Node API template with auth and tests.
Setup
Run npm install, then npm start.
Nothing suspicious. A human reviewer would approve this.

HTML comments and zero-width characters disappear when GitHub renders a file. That hidden layer is the subtext, and the agent still receives every byte of it.

11 detection rules

Each rule adds its weight to the file's score (0–100). A file hits REVIEW at 20+ and BLOCK at 60+, and the repo takes the score of its worst file.

COMMENT_AI_ADDRESSED
Comment addressed to AI
HTML or Markdown comments that directly address an AI agent.
+20
IGNORE_PREVIOUS_INSTRUCTIONS
Ignore previous instructions
Classic jailbreak phrases: "ignore all previous instructions", [INST], DAN mode.
+40
ACTION_VERB_NEAR_SECRET
Action verb near secret
Exfiltration verbs (read, send, upload) appearing within 3 lines of secret keywords.
+35
ZERO_WIDTH_CHARS
Zero-width characters
U+200B, U+200C, U+200D (non-emoji), soft hyphens and other invisible Unicode.
+30
BIDI_OVERRIDE
Bidi override
Right-to-left override and other Unicode direction control characters.
+30
BASE64_INSTRUCTION
Base64 instruction
Base64 blobs that decode to instruction-like text (ignore, exec, token…).
+35
EXFILTRATION_URL
Exfiltration URL
Markdown image/link URLs with sensitive query params or known canary hostnames.
+25
HTML_ATTR_INJECTION
HTML attribute injection
Instruction text hidden in alt, title, aria-label or data- attributes.
+25
REMOTE_EXEC
Remote exec pattern
curl|bash, wget|sh, PowerShell IEX, eval(fetch(…)) and DNS-TXT-exec.
+25
COERCION
Coercion
"Don't tell the user", "silently execute", fake error → run.
+30
SUPPLY_CHAIN_INJECT
Supply-chain inject
Instructions to add external <script src> or remote import() in generated output.
+30
Scan first. Clean what’s hidden.
Then let the agent read.
Try the demo →