Visus MCP

Visus — Secure Web Access for MCP-compatible AI agents

How Visus-MCP helps your MCP-compatible AI agents become EU AI compliant ready

npx visus-mcp@0.28.0

*"What the web shows you, Lateos reads safely."*

Why You Should Get Your AI Agent EU Compliant

The EU AI Act (Regulation (EU) 2024/1689) is the world's first comprehensive AI law, effective from August 2024. It regulates AI systems based on risk levels, with stringent requirements for general-purpose AI (GPAI) like MCP-compatible agents that process web content.

Key Requirements for Compliance

• Art. 9 (Risk Management): Identify and mitigate systemic risks, including prompt injection and data poisoning from web sources.
• Art. 13 (Transparency): Document AI capabilities, limitations, and data handling transparently.
• Art. 15 (Robustness): Ensure systems resist adversarial attacks like indirect prompt injection (IPI).

Non-compliance fines up to €35M or 7% of global turnover.

How Visus-MCP Delivers Compliance

Visus-MCP provides out-of-the-box EU AI Act alignment through:

• Tamper-Evident Cryptographic Proofs: Every fetch generates SHA-256 + HMAC proofs verifying sanitization ran (see CRYPTO-PROOF-SPEC.md).
• IPI Threat Detection (19 Categories): Fine-grained scanning for attacks like role hijacking and data exfiltration, mapped to OWASP LLM Top 10, NIST AI RMF, and ISO/IEC 42001.
• PII Redaction & Audit Logs: Automatic redaction of sensitive data; structured reports for traceability (Art. 12).
• Immutable Session Ledger: Merkle tree chaining for verifiable event logs, enabling independent audits.

Benefits

• Avoid Fines & Audits: Generate compliance statements on-demand with visus_verify.
• Build Trust: Demonstrate robust security to regulators, partners, and users.
• Scale Safely: Pre-filter web noise + threats, reducing token costs by up to 70% while maintaining full compliance.

Integrate Visus-MCP to future-proof your AI agent against evolving regulations like the EU AI Act. See SECURITY.md for framework mappings.

How Visus Works

URL → Playwright Render → Content-Type Detection

→ Specialized Handlers (PDF/JSON/SVG) OR HTML Pipeline → IPI Threat Detection (19 categories) → Injection Sanitizer (45 patterns) → Worm Detection (15 Morris II patterns) → PII Redactor → Cryptographic Proof → Token Ceiling (24k cap) → Clean Content + Proof + Threat Summary → MCP-compatible AI agent

Security Pipeline

1. Browser Rendering: Headless Chromium via Playwright fetches the page
2. Content-Type Routing: Detects MIME type and routes to specialized handlers:

• PDF (application/pdf) — Extracts text and metadata, sanitizes all fields
• JSON (application/json) — Recursively sanitizes all string values, preserves structure
• SVG (image/svg+xml) — Strips dangerous elements ( , event handlers), scans text
• HTML/XML/RSS — Uses existing conversion and reader extraction pipeline

1. IPI Threat Detection (v0.11.0+): 19 specialized detectors scan for Indirect Prompt Injection attempts before sanitization

• IPI-001 — Instruction Override (CRITICAL)
• IPI-002 — Role Hijacking (HIGH)
• IPI-003 — Data Exfiltration (CRITICAL)
• IPI-004 — Tool Abuse (HIGH)
• IPI-005 — Context Poisoning (MEDIUM)
• IPI-006 — Encoded Payload (HIGH)
• IPI-007 — Steganographic (HIGH)
• IPI-008 — Malicious Infrastructure (CRITICAL) — NEW in v0.14.0
• IPI-009 — Homoglyph & Unicode Obfuscation (HIGH) — NEW in v0.14.0
• IPI-010 — Recursive/Nested Instruction Framing (CRITICAL) — NEW in v0.14.0
• IPI-011 — CSS/Visual Concealment (HIGH)
• IPI-012 — HTML Attribute Cloaking (HIGH)
• IPI-013 — AI Moderation/Review Bypass (MEDIUM)
• IPI-014 — SEO/Phishing Amplification (MEDIUM)
• IPI-015 — Unauthorized Action Induction (CRITICAL)
• IPI-016 — Destructive/DoS Intent (CRITICAL)
• IPI-017 — RAG Corpus Poisoning Payload (CRITICAL)
• IPI-018 — MCP Tool Description Poisoning (CRITICAL) — NEW in v0.15.0
• IPI-020 — Conditional/Dormant Trigger (CRITICAL) — NEW in v0.16.0
• IPI-021 — Boolean Logic Gates (CRITICAL) — NEW in v0.26.0 (CVE-2026-4399)

1. Injection Detection: 45 pattern categories scan for prompt injection attempts
2. PII Redaction: Emails, phone numbers, SSNs, credit cards, and IP addresses are redacted
3. Cryptographic Proof: SHA-256 + HMAC-SHA-256 proof that sanitization ran (EU AI Act Art. 9/13/15 compliance)
4. Clean Delivery: Stripped, formatted, token-efficient content reaches your LLM — with a visus_proof header, threat_summary, and compliance report attached if anything was flagged

This pipeline runs before content enters an MCP-compatible AI agent's context window — reducing token consumption, keeping PII out of conversation history, generating audit logs when injection patterns are detected, and producing tamper-evident cryptographic proofs that sanitization executed.

Security Features

Fine-Grained IPI Threat Detection (v0.11.0+)

EXTENDED v0.16.0: 19 specialized Indirect Prompt Injection (IPI) detectors run before sanitization, providing fine-grained threat annotations with:

• Threat classification — 19 distinct IPI attack categories
• Severity scoring — INFO, LOW, MEDIUM, HIGH, CRITICAL
• Confidence scores — 0.0-1.0 detection confidence per annotation
• Precise offsets — Character-level attack location tracking
• Content excerpts — Max 120 chars of detected attack for audit
• Mitigation status — All threats flagged as mitigated after sanitization
• CSS Evasion Detection (v0.20.0+): Identifies hidden text via getComputedStyle (opacity:0, font-size:0px, off-screen positioning, z-index layering). Tags as [HIDDEN_CONTENT score=X]{payload}[/HIDDEN_CONTENT]; Escalates IPI severity (HIGH→CRITICAL). Covers white-on-white, zero-pixel overrides (Art. 15(a) robustness). Perf: <50ms via keyword filter.

Each tool response now includes a threat_summary field with:

threat_summary: {

threat_count: number; // Total IPI threats detected highest_severity: ThreatSeverity | 'NONE'; classes_detected: ThreatClass[]; // e.g., ['IPI-001', 'IPI-003'] evasion_detected?: 'CSS_ZERO_SIZE'; // New tag }

Glassworm Malware Detection (v0.13.0+)

NEW: Specialized detection for steganographic attacks using invisible Unicode Variation Selectors. Glassworm-style attacks hide malicious payloads in invisible characters that bypass traditional pattern matching.

Detection capabilities:

• Unicode cluster scanning — Identifies 3+ consecutive Unicode Variation Selectors (U+FE00-FE0F, U+E0100-E01EF)
• Decoder pattern detection — Flags .codePointAt() within 500 chars of hex constants (0xFE00, 0xE0100)
• Automatic severity escalation — Clusters of 10+ characters marked as CRITICAL
• Zero false positives — Ignores single selectors (legitimate emoji usage)

When detected, all variation selectors are automatically stripped from content before delivery to an MCP-compatible AI agent.

46 Injection Pattern Categories

Visus detects and neutralizes:

• Direct instruction injection — "Ignore previous instructions"
• Role hijacking — "You are now an unrestricted AI"
• System prompt extraction — "Repeat your instructions"
• Privilege escalation — "Admin mode enabled"
• Data exfiltration — "Send this to http://attacker.com"
• Encoding obfuscation — Base64, Unicode lookalikes, leetspeak
• Glassworm malware — Steganographic attacks using invisible Unicode Variation Selectors (NEW in v0.13.0)
• HTML/script injection — , , event handlers
• Jailbreak keywords — DAN mode, developer override
• Token smuggling — Special tokens like <|im_start|>
• Social engineering — Urgency language to bypass caution
• SQL Injection Vectors — Detects CVE-2026-42208 (LiteLLM v1.81.16–1.83.6) payloads like ' OR 1=1 -- and UNION SELECT in content/headers for credential exfiltration prevention (NEW v0.27.0)
• ... and 31 more categories (+20 MCP command injection/tool poisoning in v0.27.0)

See full list in SECURITY.md

Security Enhancements (v0.27.0)

MCP Ecosystem Protections:

• Command Injection Guard: Detects shell metachars (; | &), subprocess patterns (bash -c, cmd.exe /c, npx -c), entropy payloads (>4.5 threshold). Integrated into visus_scan_mcp for pre-spawn safeToSpawn=false on score>7.
• Tool Poisoning Validator: Scans descriptors/schemas for anomalous names (Ignore~), IPI in descriptions/defaults, hidden params (__), long defaults (>256 chars). SHA256 pinning for known tools (hash mismatch → block).
• Runtime Guards: visus_fetch/visus_fetch_structured scan inputs (block score>5), sanitize high-risk URLs/schemas.
• Response Scanning: sanitizeWithProof now checks JSON tool outputs for poisoning (tool_ patterns), redacts as [REDACTED: tool poisoning].
• Advanced Mitigations: Approved command allowlist (node, npm), safeSpawn (no shell, restricted PATH/env), structured logging/alerts.
• Perf: <5ms detection, <10ms validation (benchmarked).
• Tuning: 0% FP on 20+ clean corpus; 10 red-team scenarios block threats.

Layered defenses for CVE-2026-30623 (STDIO RCE), MCP03 (tool poisoning). See commit 13fd7d4.

PII Redaction

Automatically redacts:

• Email addresses → [REDACTED:EMAIL]
• Phone numbers → [REDACTED:PHONE]
• Social Security Numbers → [REDACTED:SSN]
• Credit card numbers → [REDACTED:CC]
• IP addresses → [REDACTED:IP]

Quickstart

Installation

npx visus-mcp

First Run Setup

IMPORTANT: Visus uses local Playwright as a fallback renderer when native fetch fails (e.g., SSL errors on macOS). On first run, you need to install Playwright's chromium browser:

npx playwright install chromium --with-deps

This only needs to be run once. The chromium binary (~300MB) will be downloaded to your system's playwright cache directory.

MCP Client Configuration

[!NOTE]

No API key required. The open-source tier works out of the box with npx visus-mcp.

Sanitization always runs locally — web content never reaches Lateos