Add Elcaro to your agent
One scan call between your agent's retrieval step and its reasoning loop. Under 2ms. No API key. Works today.
Test your defenses first
Point your agent — or a guard hook in your IDE — at the Specimen Kit: a page of harmless, clearly-marked injection specimens at a fixed URL. Nothing on it is a real instruction; it exists to be fetched, so you can watch detection fire end-to-end.
Direct API call
No SDK, no signup. POST the content your agent just retrieved and get a structured verdict back. Works from any language or runtime.
curl -X POST https://api.elcaro.trustfall.xyz/scan \
-H "Content-Type: application/json" \
-d '{
"content": "<the content your agent retrieved>",
"content_type": "email"
}'Returns risk_score, risk_level, flagged_techniques, and a full indicators array with matched text, confidence, MITRE TTPs, and remediation. Structured for machine consumption — log it or act on it.
Python middleware (5 lines)
Drop-in wrapper for Python agents. Wraps your retrieval step, quarantines high-risk content, and returns a ScanResult with is_safe() and the original or sanitised content.
# NOTE: the Python SDK isn't on PyPI yet — these imports assume
# you've cloned the repo so app/ and core/ are importable from your
# project root (starter in app/middleware.py). To call Elcaro without
# a repo checkout, use the Direct API in Option 01 instead.
from app.middleware import ElcaroMiddleware
from core import ContentType
# Point at the live miner or run locally
guard = ElcaroMiddleware(
miner_url="https://api.elcaro.trustfall.xyz"
)
# In your agent's retrieval step
result = await guard.scan(retrieved_content, ContentType.EMAIL)
if result.is_safe():
agent.process(result.safe_content)
else:
agent.warn(f"Blocked: {result.reason}")Three quarantine modes: replace (default — substitutes a structured notice), block (returns empty content), or warn (passes through with a warning appended). Source in app/middleware.py.
Via Telegraph Protocol
If you're already building on Telegraph, Elcaro is a registered miner. Route to it directly by id, or let Telegraph's auto-router pick it for CONTENT_MODERATION intents. Payment is per-request in USDC via x402.
# The miner is registered on Telegraph as id 8848.
# Any Telegraph client can route to it directly:
POST https://devnode.telegraphprotocol.com/engine/v1/ask/8848
Content-Type: application/json
x-payment: <x402 USDC payment>
{
"method": "POST",
"endpoint": "/scan",
"payload": {
"content": "<retrieved content>",
"content_type": "email"
}
}Five rules for safe agent pipelines
Scan before act, not after.
The injection has already influenced the agent if you scan the output. The only safe point is between retrieval and reasoning.
Treat email as highest-risk.
Untrusted sender, structured enough to carry injection reliably, real-world consequences. Email content should always be scanned — no exceptions.
Threshold at 0.5 to block, 0.3 to flag.
Score ≥ 0.5 is suspicious or dangerous — quarantine it. Score ≥ 0.3 warrants a second look but not necessarily a full block. Never let score 0.7+ through.
Pass content_type explicitly.
Elcaro weights risk by content provenance. An email scores differently than code from your own repo. The default is 'document' — be specific.
Log every quarantined result.
The flagged_techniques and indicators fields are structured and machine-readable. Log them — they're the audit trail that proves your agent was protected.
Stay ahead of attackers
New injection techniques emerge weekly. We track them, build detectors for them, and send a short brief when something worth knowing appears. No noise — only patterns your agent is likely to encounter.
- →New injection technique breakdowns — with real examples
- →Pattern releases as we add them to the detection engine
- →Practical hardening tips for specific agent use cases
Want to see it work first? See it catch something →