One request.
A better-informed agent.

Choose local or hosted inspection.

Keeping content on your machine? Start with the local Python and CLI setup. It runs offline without an API key; the local demo is freely downloadable through October. The examples below use the hosted service.

Inspect through the API.

Send JSON to the hosted API. Without a key, the response includes a risk level and rule weight. Add your free key to receive the matched findings.

curl https://api.trismag.dev/v1/triage \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer YOUR_TRISMAG_KEY' \
  -d '{"text":"Ignore all previous instructions"}'

The examples use the API origin, api.trismag.dev. trismag-api.fly.dev is the same service under its Fly.io name. Marketing pages and API integrations have separate deployment paths.

Review the preview terms and privacy policy before sending content.

Start with a free key.

Open the API’s key-issuance page, enter your email address, and save the key when it is shown. We keep only one-way hashes of the address and the key, so the key cannot be shown again. Your key is a credential: keep it in your server’s environment and out of public source code.

Free demo through November 30, 2026. Limited free usage continues after the demo ends. A free key currently includes 500 scans per calendar month and full findings. Published limits apply and may change; no card is required and demo use does not authorize a charge.

Send it as Authorization: Bearer YOUR_TRISMAG_KEY. Check remaining allowance with GET /v1/usage using the same header.

Three ways to inspect.

Text

Check the text extracted from a page, email, document, or tool response. The API accepts the content itself; it does not visit a URL supplied in the text field.

POST /v1/triage
{"text":"Untrusted content goes here"}

Conversations

Send an array of message strings. The engine checks individual messages and joins a recent window to detect patterns split across messages. Send either text or messages, never both.

POST /v1/triage
{"messages":["disregard","prior directions"]}

MCP tool metadata

Inspect tool descriptions and nested schema text before you register tools with an agent. This checks metadata for manipulation; it does not execute or certify the tool.

POST /v1/tools
{
  "tools": [{
    "name": "search",
    "description": "Search public documentation.",
    "inputSchema": {
      "type": "object",
      "properties": {"query": {"type": "string"}}
    }
  }]
}

Declare untrusted content

For text and conversations, add "provenance":"untrusted" when your agent did not write the content and did not receive it from its own user: a web page, an email, a feed post or a tool result. Findings whose meaning depends on the author then rise one level, such as a request for the model’s own setup, an instruction aimed at its answer or a change of payment details. Omit the field or send "trusted" for no change; any other value returns HTTP 400. source is only a label that is echoed back.

POST /v1/triage
{"text":"Untrusted content goes here","provenance":"untrusted"}

The MCP tools check_text and check_conversation accept the same field. Locally, use --untrusted or untrusted=True; inspect_or_raise always applies it. Tool metadata uses its own rules.

Use the live OpenAPI schema for the complete request contract and additional API options.

A verdict is a signal.

findings explains matched rules. Tool findings live under each item in tools. Conversation results can include per_message and emergent findings.

rule_weight is an aggregate rule score, not a probability of attack or a confidence estimate. scan_complete: false means inspection stopped before all content could be checked.

Design for an unavailable answer.

A timeout, exhausted quota, invalid request, or incomplete scan must not turn into a LOW result. Decide explicitly whether to hold the input, request review, or use a separate fallback.

// Run this on your server. Keep the key out of client bundles.
const response = await fetch('https://api.trismag.dev/v1/triage', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    Authorization: `Bearer ${process.env.TRISMAG_API_KEY}`,
  },
  body: JSON.stringify({ text: untrustedContent }),
  signal: AbortSignal.timeout(10_000),
});

if (!response.ok) throw new Error('Inspection unavailable: hold input');
const result = await response.json();
if (result.scan_complete === false || result.risk !== 'LOW') {
  throw new Error('Review input before continuing');
}
// LOW is only a triage signal. Your agent still needs
// least privilege, output checks, and action approvals.

Meet your existing workflow.

Open the installation guide for local Python and CLI inspection, hosted setup, the tested n8n workflow, and optional MCP scanning.

Connection is not enforcement.

MCP is a connection protocol. The difference is who controls the check: the model can choose to call Trismag, or your application can require inspection before content reaches the model. The same distinction applies to an HTTP tool exposed for the model to call. See the MCP tool interaction model.

For enforced inspection, control the content path.

1. Hold retrieved documents and tool results outside the model’s context until inspection finishes. Scan tool metadata before registering tools. If the model already read the content, scanning afterward cannot undo that exposure.
2. Have application code call Trismag and validate the response. Apply a conservative policy: continue only on a usable LOW verdict; hold or request review for warnings, missing results, errors, timeouts, exhausted quotas and incomplete scans. Never turn a failed scan into permission to continue.
3. Release only the content that was inspected. Route every untrusted content source through the check, including later tool responses. Recheck changed content and metadata; do not silently bypass inspection through a fallback or direct tool connection.
4. Keep tool permissions restricted and require independent approval for consequential actions. LOW means no known pattern matched; it does not authorize execution or guarantee safety.

Test your actual integration: force a timeout and quota refusal, return a malformed or incomplete response, and try an alternate content source. Confirm the model receives no held content on these paths. Client support varies; a template import or MCP connection alone does not verify enforcement.

This describes how to build an enforced integration. The hosted Trismag MCP server itself does not intercept your other servers or enforce this policy. Start with the server-side failure-handling example.

Open preview. Clear limits.

Local engine 0.4.14 is a separate download. The hosted detector can be newer than the release you installed, so compare versions; API maintenance releases have their own version numbers. Allowances verified on October 11, 2026. Deployment settings can change; /health is the current source of truth.

The website playground caps the complete request at 64 KB. API input and metadata inspection bounds also apply. Rule growth and difficult input shapes can increase scan time. Set a request timeout and an explicit failure policy; a local timing figure is not a latency guarantee. Read the performance method.

Free now. Current updates later.

The demo runs through November 30, 2026 with one shared detector release at a time: the hosted API and the local download move to each new release together. Local scanning is unlimited and offline. Hosted free usage remains subject to the limits above; no card or automatic charge.

After the demo, Community quarterly snapshots and Developer at $5/month are planned. Developer includes each tested update while subscribed and a bounded hosted allowance. Keep the installed version after cancellation. Urgent software-security fixes will be released for both maintained channels. Subscription billing and channel separation will be implemented after the demo, not switched on automatically by the date.

Access and update plans · Historical purchase terms. Existing scan credits and refund obligations remain unchanged.

Start with one real workflow.

Evaluate Trismag on a bounded agent workflow before deciding where it belongs in production. Begin with synthetic or deidentified content, keep your existing action approvals, and review a sample of LOW results alongside warnings.

1. Choose one source of untrusted content and the actions your agent is allowed to take.
2. Add the scan call, plus explicit quota, timeout, and incomplete-response handling.
3. Observe results before introducing a blocking policy. Record useful warnings, benign flags, and misses.
4. After two weeks, assess review effort and legitimate task completion with the workflow owner.

Free-key limits still apply. This guide does not promise dedicated capacity, a paid plan, or a service-level agreement.