Gatekeeper: AI Prompt Injection Scanner
Overview
Gatekeeper is a client-side prompt injection scanner that analyzes LLM inputs for manipulation patterns before they ever reach a model. It runs entirely in the browser, scans against 21 detection rules across 7 attack categories, and returns a scored risk assessment with explanations for every finding.
I built this because prompt injection keeps coming up in every AI security conversation, but almost nobody has actual tooling for it. Security teams are either manually reviewing prompts or relying on the model provider to handle it. That’s not a strategy. Gatekeeper gives you a first line of defense, something concrete you can run against inputs before they hit production.
What it detects
The rule engine covers the patterns I’ve studied through OWASP’s LLM Top 10, published jailbreak research, and my AI security coursework:
- Role hijacking catches instruction overrides, persona reassignment, DAN/jailbreak keywords, and developer mode claims
- Data exfiltration flags attempts to extract system prompts, conversation history, and training data details
- Delimiter abuse identifies fake system tags, instruction boundary markers, and code block injection
- Encoding tricks detects base64 payload references, character splitting evasion, and reverse text instructions
- Indirect injection spots embedded instructions hidden inside data and invisible text techniques
- Context manipulation catches hypothetical framing, false authority claims, and emotional pressure
- Output manipulation flags attempts to suppress safety disclaimers and forced compliance patterns
Each rule maps to a specific OWASP LLM reference and includes an explanation of why the pattern is dangerous, not just that it matched.
How it works
Paste a prompt into the terminal-style input and hit scan. The engine runs every rule against the text and returns findings as structured log entries, sorted by severity. Each entry shows the matched text highlighted inline, the attack category, and a severity tag. Click any finding to expand the full explanation, the exact matched string, and the OWASP reference.
The risk score aggregates severity across all findings into a 0 to 100 scale. A clean prompt scores 0. A prompt with multiple critical injection patterns will push into the 80 to 100 range.
Everything runs client-side. Nothing leaves the browser. No API calls, no data collection, no telemetry. The detection logic is pattern matching and regex, which means it’s fast and costs nothing to run.
Why I built it this way
I chose client-side pattern matching over calling an external API because the whole point of the tool is protecting sensitive inputs. Sending prompts to a third-party service for analysis defeats the purpose. The trade-off is that regex-based detection won’t catch everything a fine-tuned classifier would, but it catches the well-documented patterns that make up the majority of real-world injection attempts.
The terminal-style UI was intentional. This is a security tool, not a marketing page. The interface should feel like something an engineer would actually use at their desk, not something designed to look good in a pitch deck.
Tech stack
- Next.js (React framework)
- Vanilla JavaScript rules engine
- Deployed on Vercel
- No external dependencies or API keys required
What’s next
The current rule set is a starting point. I plan to expand it as new injection techniques get published and add support for batch analysis so you can scan multiple prompts from a file. The Next.js build also opens the door for server-side API routes if I want to add more computationally expensive analysis later without exposing the logic client-side.
Stack: Next.js, JavaScript, Vercel