Prompt injection scanner for Anthropic Claude Enterprise

Four attack surfaces specific to Claude Enterprise

1. Shared project file uploads. Claude Enterprise projects allow team members to upload files (PDFs, images, Word documents) that become part of the project's persistent context. Every conversation started in that project includes the project files. An employee — or a compromised employee account — can upload an image file containing typographic prompt injection that instructs Claude to exfiltrate subsequent conversation content, change its role, or output malicious content to other team members. The damage is organisational, not individual: one malicious upload affects all project participants until the file is removed and the project context is refreshed.

2. Admin-managed MCP server integrations. Claude Enterprise allows org admins to configure organisation-wide Model Context Protocol (MCP) server integrations that all users in the organisation can access. MCP tools can return any data type, including images. A third-party MCP server integration that fetches data from an external service (a design tool, a monitoring dashboard, a customer CRM) can return adversarial images as part of its tool output. Because the MCP server is admin-configured rather than user-configured, its outputs receive implicitly higher trust — but trust level does not correlate with image safety. Every image returned by an MCP tool should be scanned before Claude processes it.

3. Conversation attachments in SSO-linked sessions. In Claude.ai Enterprise, users can attach images directly to individual conversations. Unlike shared project files (which affect all users), conversation attachments affect only the current session. However, in multi-user collaborative workflows (where conversation links are shared across the organisation), an attachment uploaded by one user can affect another user who opens the shared conversation link. The trust boundary is the organisation domain — any user with the correct SSO credentials can open a shared conversation, including an attacker who has compromised one account via credential stuffing or phishing.

4. Custom system prompts with embedded images. Claude Enterprise allows admins to define custom system prompts for projects. If an admin's system prompt includes an image URL (via a Markdown image reference or a URL placeholder), Claude will fetch and process that image as part of the system prompt. An attacker who can modify an admin's system prompt (via a compromised admin account or a social engineering attack) can inject an adversarial image into the system prompt level — the highest-privilege injection point in the entire hierarchy.

Integration: MCP server wrapper with scan gate (TypeScript / Node.js)

import { Server } from "@modelcontextprotocol/sdk/server/index.js";
import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
import axios from "axios";
import fs from "fs";

const GLYPHWARD_KEY = process.env.GLYPHWARD_API_KEY!;
const INJECTION_THRESHOLD = 65;

async function scanImageBuffer(imageBuffer: Buffer, source: string): Promise<{score: number; scanId: string}> {
  const resp = await axios.post(
    "https://glyphward.com/v1/scan",
    { image: imageBuffer.toString("base64"), source },
    { headers: { Authorization: `Bearer ${GLYPHWARD_KEY}` }, timeout: 8000 }
  );
  return { score: resp.data.score, scanId: resp.data.scan_id };
}

async function safeImageToolResult(imageBuffer: Buffer, mimeType: string, source: string) {
  let scan: { score: number; scanId: string };
  try {
    scan = await scanImageBuffer(imageBuffer, source);
  } catch {
    // Fail-closed: scanner unreachable → redact
    return { type: "text", text: "[Image redacted: scan service unavailable]" };
  }

  if (scan.score >= INJECTION_THRESHOLD) {
    console.error(`MCP image redacted: score=${scan.score}, scan_id=${scan.scanId}, source=${source}`);
    return { type: "text", text: "[Image redacted: adversarial content detected]" };
  }

  return {
    type: "image",
    data: imageBuffer.toString("base64"),
    mimeType,
  };
}

// Example: MCP tool that fetches a screenshot and scans it before returning
const server = new Server({ name: "safe-screenshot-tool", version: "1.0.0" }, { capabilities: { tools: {} } });

server.setRequestHandler("tools/call", async (request) => {
  if (request.params.name === "get_screenshot") {
    const { url } = request.params.arguments as { url: string };

    // Fetch the screenshot image (your implementation here)
    const screenshotBuffer = await fetchScreenshot(url);

    // Scan before returning to Claude
    const safeContent = await safeImageToolResult(screenshotBuffer, "image/png", `mcp_screenshot:${url}`);

    return {
      content: [safeContent],
    };
  }
  throw new Error(`Unknown tool: ${request.params.name}`);
});

const transport = new StdioServerTransport();
await server.connect(transport);

# Python: Pre-upload scan gate for shared project file uploads
# (integrate with your internal file management system or Claude API wrapper)
import base64, requests, os
from pathlib import Path

GLYPHWARD_KEY = os.environ["GLYPHWARD_API_KEY"]
INJECTION_THRESHOLD = 65
IMAGE_EXTENSIONS = {".jpg", ".jpeg", ".png", ".gif", ".webp", ".bmp", ".tiff"}

def scan_project_file_upload(file_path: str, uploader_user_id: str) -> bool:
    """
    Returns True if the file is safe to add to the project context.
    Returns False (and logs) if the file contains adversarial image content.
    """
    ext = Path(file_path).suffix.lower()
    if ext not in IMAGE_EXTENSIONS:
        # For PDFs and Word docs, extract images first (out of scope for this example)
        # For text-only files, pass through (text-only scanner handles these)
        return True

    with open(file_path, "rb") as f:
        image_bytes = f.read()

    try:
        resp = requests.post(
            "https://glyphward.com/v1/scan",
            json={
                "image": base64.b64encode(image_bytes).decode(),
                "source": f"enterprise_project_upload:{uploader_user_id}",
            },
            headers={"Authorization": f"Bearer {GLYPHWARD_KEY}"},
            timeout=8,
        )
        resp.raise_for_status()
        result = resp.json()
    except Exception:
        # Fail-closed: scanner unreachable → reject the upload
        return False

    if result["score"] >= INJECTION_THRESHOLD:
        print(
            f"Project upload rejected: user={uploader_user_id}, file={file_path}, "
            f"score={result['score']}, scan_id={result['scan_id']}"
        )
        return False
    return True

Get early access

Coverage matrix

Related questions

Further reading

• Prompt-injection scanner for Claude API (direct) — request-level scan gate for API integrations.
• Prompt-injection scanner for MCP servers — general MCP tool output scanning pattern.
• Multimodal prompt injection in agentic RAG pipelines — multi-hop injection in agent loops.
• Prompt injection prevention best practices — full defence-in-depth stack.
• Multimodal LLM security API — Glyphward API overview.