Catch hidden instructions in a document or web page before an agent reads it.
Content scan, called scan_content over MCP.
What gets better
A person cannot see invisible Unicode at all. The scan reads every character and names the technique.
Before: what you give it
A page URL to fetch, or raw text you already have.
Quarterly shipping policy Parcels over 20 kg ship by freight.[69 invisible characters] Returns are accepted within 30 days.
After: what comes back
A shipping policy that reads normally to a person. The line the scanner flags is made of characters no mainstream renderer displays. The report below was produced by the scanner, then its findings listed one per line.
verdict: caution, risk 34/100 CRITICAL Hidden Unicode TAG-block characters in the text
What you get
A verdict and risk score, with a finding for each hidden or obfuscated payload and each page element built to steer a browsing agent.
What it cannot do
A URL scan reads the first 200,000 characters of the raw response and does not run scripts, so content added by JavaScript after load is not seen.
Who it is for
- Developers building agents that summarize or browse
- Teams feeding customer documents to a model
Free and Pro
Free: 20 requests a minute per IP address, no sign-in. Pro adds: A semantic pass for visible phrasing aimed at the model instead of the human reader.
Use it from your assistant
Add Preflight as an MCP server once, then call scan_content by name or describe the job.
curl -X POST https://preflight.allthepossibles.com/api/scan-content -H 'content-type: application/json' -d '{"content":"Quarterly shipping policy\n\nParcels over 20 kg ship by freight.\n\nReturns are accepted within 30 days."}'Try it here
The box starts with the example input. Run it, then swap in your own.