packages/intercept-fetch/ — Security tooling for LLM web fetches: MCP server, Claude hooks, OpenCode plugin. Prevention layer.
packages/secure-output/ — Zero-dependency library that detects prompt-injection compromise in LLM conversations. Detection layer.
packages/session-inspector/ — Terminal UI to browse Claude Code and OpenCode session transcripts, flagging compromise inline. Inspection layer.

Quick start#

pnpm install
pnpm -r build
pnpm -r test        # 205+ tests across workspace

intercept-fetch#

Security tooling for LLM web fetches. Organized by host:

intercept-fetch/src/
├── core/           # shared: analysis, rate-limiting, audit logging
├── mcp/            # MCP server (intercept_fetch tool)
├── claude/         # Claude Code hooks (PreToolUse/PostToolUse)
└── opencode/       # OpenCode plugin (tool.execute.before/after)

MCP server (Claude Code / any MCP host)#

{
  "mcpServers": {
    "intercept-fetch": {
      "command": "node",
      "args": ["/path/to/secure-llm/packages/intercept-fetch/dist/index.js"]
    }
  }
}

Add "deny": ["WebFetch"] to force all fetching through intercept_fetch.

Claude hooks#

node packages/intercept-fetch/src/claude/pre-tool-use.ts   # rate limiting
node packages/intercept-fetch/src/claude/post-tool-use.ts  # injection scan

Configure via secure-hook-config.json or env vars:

Variable	Default	Description
`SECURE_HOOK_MAX_WEB_REQUESTS`	`20`	Max web fetches per session
`OPENROUTER_API_KEY`	—	Enables LLM-based injection analysis

OpenCode plugin#

Add to opencode.json:

{
  "plugin": [
    ["intercept-fetch/opencode", {
      "maxWebRequestsPerSession": 20,
      "auditLogPath": "~/.intercept-guard/findings.jsonl"
    }]
  ]
}

The plugin hooks into tool.execute.before (rate limiting) and tool.execute.after (injection detection + audit logging + stderr warnings).

What it blocks#

Non-HTTPS schemes
Private IPs (RFC1918), localhost, link-local
Cloud metadata endpoints (169.254.169.254, metadata.google.internal)
Raw IP addresses, IPv6 literals
URLs with embedded credentials
Rate limit exceeded

What it sanitizes#

Strips <script>, <style> tags and inline event handlers
Extracts text content from HTML
Detects prompt injection (direct override, encoding, typoglycemia, spaced evasion)
Truncates oversized responses without corrupting multibyte UTF-8

secure-output#

Zero-dependency detection library for prompt-injection compromise.

pnpm -F secure-output build
pnpm -F secure-output test

Function	What it does
`detectInjection(text)`	Matches known injection patterns after normalization (base64, zero-width, NFKC, homoglyph, typoglycemia)
`detectObfuscation(text)`	Flags obfuscation by presence (invisible chars, mixed script, encoded blobs)
`detectCompromise(input)`	Flags when assistant echoes an injection pattern from a tool result
`isWebContentTool(name)`	Host-agnostic tool name matching (case-insensitive, covers both hosts)

session-inspector#

Terminal UI to browse Claude Code and OpenCode session transcripts.

node packages/session-inspector/src/index.ts            # inspect current project
node packages/session-inspector/src/index.ts --follow   # live-tail the active session
node packages/session-inspector/src/index.ts --list     # list projects with transcripts

Reads ~/.claude/projects/<encoded-cwd>/<sessionId>.jsonl (Claude) or ~/.local/share/opencode/storage/ (OpenCode).

Testing#

pnpm -r test                      # all unit tests (vitest)
pnpm -F intercept-fetch test      # intercept-fetch only
pnpm -F session-inspector test    # session-inspector only

Eval suites#

Command	Suite	What it tests
`pnpm eval`	`evals/injection/`	LLM injection detection
`pnpm eval:mcp`	`evals/mcp-blocking/`	MCP server blocking + approve flow
`pnpm eval:sanitize`	`evals/sanitization/`	HTML stripping + injection flags
`pnpm eval:agent`	`evals/agent/`	Agent + MCP tool-use integration

Configure Feed