How it works
Defenses
Attack Patterns MCP Attack Atlas What we catch Hardening manual OWASP LLM Top 10 MITRE ATLAS
Learn
Encyclopedia (new) Agent Security 101 Blog Reports CVP runs Thesis
Resources
Docs GitHub Action (live) vs Lakera vs Promptfoo Team
Theme
How It Works

An input inspection layer you invoke before your agent acts.

The filter model
sunglasses://how it works
What it is

Sunglasses is an input inspection layer you invoke deliberately. Scan a file, a repo or a string. Let the Claude Code hook inspect tool calls before they run. Call the MCP server from your agent. It flags. It does not silently strip.

Untrusted input → Sunglasses filter → Your agent
~0.7ms
Avg Scan
1554
Patterns
118
Categories
13
Languages
17
Normalizations
MIT
License

Local. No cloud. No API key. No telemetry. Your agent talks to Sunglasses over local stdio or in process Python calls.

Four decisions. Block, quarantine, allow redacted or allow.

Each scan returns exactly one decision.

BLOCK

A high severity attack matched. Stop and refuse.

QUARANTINE

Suspicious. Hold and surface for review before acting.

ALLOW_REDACTED

Proceed, but with the offending span removed/neutralized.

ALLOW

Clean. Proceed normally.

Wire it into YOUR stack

One filter. Many wiring options. Pick the page that matches the agent you use.

Claude Code · MCP

Claude Code / Claude Desktop

One command registers the local scan server. Then require a scan before Claude acts on untrusted files, web content or tool output.

Wire it up →
AI IDEs · MCP

Cursor, Cline, Windsurf & Zed

One canonical MCP setup for the VS Code family editors. Scan files, terminal output and web fetches before the agent acts.

Wire it up →
Personal agent · MCP

OpenClaw

Register Sunglasses as a third party MCP server, then scan channel messages, tool results and handoffs before the runtime acts.

Wire it up →
Terminal · MCP

Warp terminal

Terminal output is a top attack surface. Route command results and repo files through the scan tool before the agent acts.

Wire it up →
Autonomous · Cron

Hermes Agent

A pre read guard for unattended cycles. Scan inbox messages, web extracts and file reads before the agent makes a plan.

Wire it up →
Framework · Scan tool

LangChain

The real SunglassesScanTool scan retrieved docs, tool output and user input at the boundary.

Wire it up →
Framework · Multi agent

CrewAI

The real sunglasses_scan tool. Scan handoffs and tool results before the next agent acts.

Wire it up →
Microsoft · Multi agent

Microsoft AutoGen

Scan group chat messages, task summaries and forged approvals before they reach the next agent.

Wire it up →
OpenAI · Agents SDK

OpenAI Agents SDK

Guard Runner.run() input and tool output with a local SunglassesEngine scan.

Wire it up →
Custom · SDK / Engine

Custom Python agent

Drop engine.scan() in front of any LLM or tool call. The canonical route for any stack.

Wire it up →

Same filter underneath. Different wiring based on your stack.

See it work in 3 seconds

No Python nearby? The online scan page runs the same three-way decision on whatever you paste.

Install Sunglasses and run the built in demo. 10 real attack scenarios get blocked with category + severity reported for each.

terminal
python3 -m venv sunglasses-env
source sunglasses-env/bin/activate
pip install sunglasses
sunglasses demo

Windows. Replace source sunglasses-env/bin/activate with sunglasses-env\Scripts\activate.

FAQ

What is Sunglasses?+
SUNGLASSES is a free, open-source input inspection layer. It does not sit invisibly in front of your agent and sanitise everything it reads. Nothing does. It gives you three surfaces you invoke deliberately. The sunglasses scan command, the Claude Code firewall hook and the MCP server. It flags. It does not silently strip. Content it cannot inspect is reported as not inspected, never as clean.
How does Sunglasses work?+
Untrusted text passes through engine.scan() first. The scan returns one of four decisions. Block, quarantine, allow_redacted or allow. Based on 1554 patterns across 118 categories. Scan latency is ~0.7ms on a short input, ~4ms on a typical attack string.
What does Sunglasses detect?+
Prompt injection, credential exfiltration, memory poisoning, tool output poisoning, cross agent injection, retrieval poisoning, social engineering and encoded attack evasions across 13 languages with dedicated patterns. 1554 patterns across 118 categories. 17 normalization techniques to catch obfuscated attacks.
What agents does Sunglasses work with?+
Claude Code, Claude Desktop, OpenClaw, the VS Code family AI IDEs (Cursor, Cline, Windsurf, Zed) over one MCP setup, Warp, Hermes Agent, LangChain, CrewAI, Microsoft AutoGen, OpenAI Agents SDK and any custom Python agent. See the wiring grid above. Each option links to a full walkthrough.
Do I need an API key or cloud service?+
No. Sunglasses runs entirely on your machine. No API key, no cloud service, no telemetry. Install from PyPI into a Python virtual environment.
Is the filter mandatory or optional?+
Depends on the wiring. Two frameworks ship a built in scan tool. LangChain (SunglassesScanTool) and CrewAI (sunglasses_scan). Every other agent wires in over the MCP server or a direct SunglassesEngine().scan() call. Importing or registering makes scanning available. It becomes mandatory when your workflow requires the scan at each untrusted input boundary before the agent acts.
How fast is the filter?+
Scan cost scales with input length: ~0.7ms on a short input, ~4ms on a typical attack string, ~26 KB/sec sustained single threaded. Invisible next to LLM call latency.