System boundary
Tripwire Inspect processes user-chosen selected text, visible main-frame page text and, in Deep DOM mode, hidden text, comments, structured data and text-bearing attributes. It deliberately excludes form-field values and passwords.
Inspect is a browser-side signal detector. Core provides the same typed detector to the command line. Guard exposes the detector as a local stdio MCP tool; the connected host remains responsible for enforcement at dangerous action sinks.
Known detection coverage
The versioned ruleset checks deterministic signals associated with common injection and exfiltration patterns.
- Instruction overrides, fake roles and jailbreak phrasing.
- Secret solicitation and sensitive-data exfiltration.
- Clearly dangerous shell activity and confirmation bypass.
- Safety-control bypass and evidence removal.
- Invisible Unicode, compatibility characters, scrambled instruction words and explicit encoded payloads.
Known gaps
- Novel semantic paraphrases, unsupported languages, homoglyphs and sophisticated encodings.
- Attacks that require user-goal, identity, conversation, provenance or later tool-call context.
- Instructions present only in images, audio, video, PDFs, cross-origin frames or agent-specific reader APIs.
- Adaptive attacks designed against the public ruleset.
How to read a decision
- Allow
- No known rule matched. This is not a safety certificate.
- Review
- A suspicious signal or source context needs human judgment.
- Recommend block
- A high-severity known pattern matched. Enforcement still belongs inside the agent or policy layer.
- Signal score
- A deterministic heuristic, not a probability or calibrated risk estimate.
Required companion controls
Production agents should combine content inspection with source-aware policy enforcement.
- Least privilege and narrowly scoped tools.
- Origin restrictions, sandboxing and source provenance.
- Outbound URL controls and tool-argument validation.
- Human confirmation for consequential actions.
- Auditable logs, adversarial evaluation and incident response.
Validation status
The repository includes a 43-case behavior regression corpus, a balanced 100-case public evaluation and 28 automated tests. The evaluation currently reports 85.0% accuracy, 83.0% precision, 88.0% recall and 82.0% specificity.
It is not an independent benchmark. The complete confusion matrix, known misses and machine-readable results are published on the evaluation page.