Shields Virtual Servers from prompt injection, SQL attacks, harmful content, secret leaks, malware, and data exfiltration.

Reshapes payloads, normalizes inputs, converts HTML to Markdown, repairs JSON, and translates timezones.

Throttles call volume, caches idempotent tool results, manages retries, caps output size, and trips circuit breakers.

Redacts PII, enforces web scraping/robots licensing terms, and injects privacy notices or license headers.

Validates tool arguments and responses against JSON schemas, static parameters, and live citations.

Customizes Open Telemetry span attributes, sends HTTP webhooks, and exports operational metrics/traces.

Formats code, trims whitespace, pretty-prints JSON, and encodes specialized data streams.

Extracts JWT claims during authentication and enforces fine-grained Role-Based Access Control (RBAC).

Evaluates calls against policy engines (native, MAC, OPA, Cedar) for centralized policy decision-making.

Deny-list filter that blocks requests containing banned words, terms, or regex patterns.

Detects risky SQL in prompts/arguments; strips SQL comments or blocks execution to stop SQL injection.

Detects harmful content categories (self-harm, violence, hate speech) in prompts and tool outputs.

Runs AI-based moderation using external providers (IBM Watson, IBM Granite Guardian, OpenAI).

Detects keys, tokens, and credentials in inputs/outputs to redact or block them from context windows.

Identifies suspicious encoded data-exfiltration patterns hidden inside payload parameters.

Checks resource URLs against domain blocklists to prevent fetching from malicious web hosts.

Checks URLs, domains, IPs, and local files against VirusTotal v3 for threat intelligence and malware scans.

Restricts fetched web resources to a configured list of known-safe file types and extensions.

Strips XSS vectors from fetched HTML, offering optional conversion to plain text.

Scans code generated in tool outputs for unsafe execution patterns prior to returning to the client.

Generates short-lived OAuth2 bearer tokens from vault-stored secrets for backend calls.

Example filter validating content size and protocol rules; serves as a template for custom resource filters.

Standardizes Unicode, casing, dates, numbers, and whitespace to ensure consistent tool arguments.

Performs configurable find-and-replace for bad words or profanity in tool payloads.

Converts raw HTML retrieved from web resource fetches into clean Markdown for LLM consumption.

Tidies Markdown formatting syntax and removes inconsistencies in prompt or resource text.

Automatically repairs slightly malformed JSON in tool outputs to ensure valid downstream parsing.

Uses an LLM to summarize long text content, replacing lengthy tool/resource outputs with concise text.

Converts ISO timestamps between server UTC and user local timezones in arguments and results.

Uses ALTK JSON queries to extract specific fields from massive JSON tool responses.

Injects configured HTTP headers into outbound resource-fetch requests.

Throttles and limits requests per tool, per user, or per tenant to curb abuse and manage costs.

Caches idempotent tool results in memory using argument keys to return instant responses.

Retries failed tool calls using exponential backoff, jitter, and status code triggers (e.g., 429, 500, 503).

Enforces min/max character or token length limits; truncates or blocks oversized tool responses.

Trips a per-tool breaker when error rates exceed thresholds to prevent cascading backend failures.

Enforces maximum execution duration per tool call; warns or blocks requests that hang or exceed SLAs.

Advisory cache reusing tool results when new call inputs meet cosine similarity thresholds on fields.

Detects and masks PII (SSNs, emails, payment card numbers) for GDPR, HIPAA, and PCI-DSS compliance.

Inspects robots.txt and licensing terms on fetched web content to honor publisher AI opt-out rules.

Injects configurable privacy notice text into prompts following resource fetches.

Injects legal license headers into tool outputs and fetched content using appropriate comment syntax.

Validates tool arguments and results against JSON schemas to catch malformed structures.

Statically checks argument types, required parameters, and allowed enum values before tool execution.

Validates HTTP status codes and keywords of links/citations in outputs to catch broken references.

Customizes OpenTelemetry span attributes on gateway traces (e.g., adding user or tenant IDs).

Sends HTTP webhook notifications on policy violations, tool errors, or rate-limit breaches.

Exports execution metrics, traces, and audit logs to external monitoring stacks (Prometheus, Elastic).

Normalizes code indentation, trims trailing whitespace, and pretty-prints JSON outputs.

Encodes binary streams or specialized payload formats into structures optimized for LLMs.

Extracts caller identity claims from OAuth JWT bearer access tokens during initial authentication.

Enforces

Serial & chained. Primary mode for policy enforcement.

Serial & chained. Reshapes payloads or redacts sensitive data.

Serial. Logs violations and discards payload modifications.

Runs in parallel with other Parallel plugins; stops at first block.

Background side-effect; executes after all other modes for telemetry.

Plugin is disabled for the target scope.